Command Injection Affecting org.apache.karaf.instance:org.apache.karaf.instance.core package, versions [,4.4.12)

Affected versions of this package are vulnerable to Command Injection via InstanceServiceImpl in the instance-management service, where doStart and the self-restart path of restartInstance concatenate unquoted javaOpts into a command executed by a shell. An attacker can execute arbitrary OS commands as the Karaf process user by supplying shell metacharacters in javaOpts through the instance:* commands or corresponding JMX operations.

Notes

• The command-entry path requires an authenticated shell user, but before the fix the instance command scope had no ACL, so any authenticated user could invoke instance:* regardless of role.

Workarounds

• Set karaf.secured.command.compulsory.roles=admin in etc/system.properties to require admin authorization for command scopes without configured role requirements, reducing access to the vulnerable instance operations.
• Restrict role assignments in etc/users.properties so only authorized principals can access instance:* commands and InstancesMBean, limiting who can supply javaOpts to the vulnerable operations.
• Accept javaOpts for instance:create, instance:start, instance:change-opts, and InstancesMBean operations only from fully trusted operators, reducing the chance that untrusted shell metacharacters reach the vulnerable launch path.

• Apache Security Advisory
• GitHub Commit
• GitHub Commit karaf-4.4.12
• GitHub Pull Request