CVE-2016-0710
published 2016-04-11CVE-2016-0710: Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via…
PriorityP277high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
52.35%
98.8th percentile
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | jetspeed | <= 2.3.0 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated POST requests to /jetspeed/services/usermanager/users with 'role' or 'user' parameters containing SQL metacharacters, indicating SQL injection attempts against the User Manager REST API. ↗
- →Detect POST requests to /jetspeed/services/usermanager/users creating new users followed immediately by a role assignment POST to /jetspeed/services/usermanager/users/<username> with 'roles=admin', indicating exploitation of the unsecured User Manager REST API to create rogue admin accounts. ↗
- →Detect multipart file upload POST requests to the Jetspeed Import/Export endpoint containing a ZIP file with path traversal sequences (e.g., '../../webapps/jetspeed/') in archived file names, indicating ZIP path traversal exploitation. ↗
- →Alert on GET requests to /jetspeed/<random>.jsp immediately after a ZIP file upload to the same session, indicating execution of a dropped JSP web shell. ↗
- →Monitor for DELETE requests to /jetspeed/services/usermanager/users/<username> shortly after admin user creation and file upload activity, as the exploit deletes the created user during cleanup. ↗
- →Look for newly created .jsp files appearing under the webapps/jetspeed/ directory on the server filesystem, especially with random alpha filenames, as indicators of a successfully uploaded web shell. ↗
- ·The exploit targets Apache Jetspeed 2.3.0 and potentially unknown earlier versions; version 2.3.1 and later are patched. Scope detection rules accordingly. ↗
- ·The exploit is destructive: successful file upload exploitation has been observed to permanently clobber the Jetspeed web interface with no known workaround. ↗
- ·The Metasploit module targets both Linux and Windows platforms (ARCH_JAVA), so path separators in traversal strings differ (forward slash vs backslash); detection rules should account for both. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Jetspeed vulnerable to SQL Injection
osv·2022-05-17
CVE-2016-0710 [HIGH] Apache Jetspeed vulnerable to SQL Injection
Apache Jetspeed vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
GHSA
Apache Jetspeed vulnerable to SQL Injection
ghsa·2022-05-17
CVE-2016-0710 [HIGH] CWE-89 Apache Jetspeed vulnerable to SQL Injection
Apache Jetspeed vulnerable to SQL Injection
Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
No detection rules found.
Exploit-DB
Apache Jetspeed - Arbitrary File Upload (Metasploit)
exploitdb·2016-03-31·CVSS 7.2
CVE-2016-0710 [HIGH] Apache Jetspeed - Arbitrary File Upload (Metasploit)
Apache Jetspeed - Arbitrary File Upload (Metasploit)
---
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule 'Apache Jetspeed Arbitrary File Upload',
'Description' => %q{
This module exploits the unsecured User Manager REST API and a ZIP file
path traversal in Apache Jetspeed-2, versions 2.3.0 and unknown earlier
versions, to upload and execute a shell.
Note: this exploit will create, use, and then delete a new admin user.
Warning: in testing, exploiting the file upload clobbered the web
interface beyond repair. No workaround has been found yet. Use this
module at your own risk. No check will be implemented.
},
'Author' => [
'Andreas Lindh', # Vulnerability discovery
'wvu' # Met
Metasploit
Apache Jetspeed Arbitrary File Upload
metasploit
Apache Jetspeed Arbitrary File Upload
Apache Jetspeed Arbitrary File Upload
This module exploits the unsecured User Manager REST API and a ZIP file path traversal in Apache Jetspeed-2, version 2.3.0 and unknown earlier versions, to upload and execute a shell. Note: this exploit will create, use, and then delete a new admin user. Warning: in testing, exploiting the file upload clobbered the web interface beyond repair. No workaround has been found yet. Use this module at your own risk. No check will be implemented.
No writeups or analysis indexed.
http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andhttp://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_uploadhttps://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3Ehttps://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710https://www.exploit-db.com/exploits/39643/http://haxx.ml/post/140552592371/remote-code-execution-in-apache-jetspeed-230-andhttp://packetstormsecurity.com/files/136489/Apache-Jetspeed-Arbitrary-File-Upload.htmlhttp://www.rapid7.com/db/modules/exploit/multi/http/apache_jetspeed_file_uploadhttps://mail-archives.apache.org/mod_mbox/portals-jetspeed-user/201603.mbox/%3C046318A1-226E-453F-9394-B84F1A33E6A4%40bluesunrise.com%3Ehttps://portals.apache.org/jetspeed-2/security-reports.html#CVE-2016-0710https://www.exploit-db.com/exploits/39643/
2016-04-11
Published