SECURITY NOTICE: Seven DSpace vulnerabilities verified in item import/export, process management, registration, request for copy, etc.
Tim Donohue
All,
Seven DSpace backend security advisories have been released that impact all supported versions of DSpace 8.x - 10.x. (Please note that some of these vulnerabilities impact unsupported DSpace releases back to 1.x.x.) These vulnerabilities are listed in order of severity.
GHSA-4783-qprq-45x8 : Process DELETE service method and REST endpoints are not protected
Severity: High (7.5 out of 10.0 using CVSS v3)
Affected Versions: 7.0 <= 7.6.7, 8.0 <= 8.4, 9.0 <= 9.3, 10.0
Patched Versions: 8.5, 9.4, 10.1
Reported by: Leszek Raszka
Fixed by: Kim Shepherd, 4Science
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
Any anonymous user is able to potentially delete Processes in any state, if the attacker can guess the (sequential) ID of the process. This can result in data loss for completed processes (including process logs or output files) or processes being halted/deleted before completion. The attacker is unable to view the process they are deleting, but even a random attack can be significant.
GHSA-5xvx-grf4-4p7w : Path Traversal Vulnerability on ItemExport via bitstream name
Severity: High (7.6 out of 10.0 using CVSS v3)
Affected Versions: 1.x.x <= 7.6.7, 8.0 <= 8.4, 9.0 <= 9.3, 10.0
Patched Versions: 8.5, 9.4, 10.1
Reported by: Mohammad Sheeban
Fixed by: Kim Shepherd, 4Science
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
If a submitter deposits a bitstream that has a filename with path traversal characters (e.g. “..”, “/” or “\”), then when an administrator exports that Item (via the “export” command) the malicious bitstream may be written to any arbitrary path writable by the DSpace backend. This is a path traversal vulnerability that could result in files being overwritten in DSpace configuration, storage, Tomcat directories, or other system directories writable by the DSpace backend. However, this attack can only be realized if an administrative user exports the malicious bitstream.
GHSA-fc3c-5p62-2cx7 : Path Traversal / Arbitrary File Write via `-z` Parameter in REST-Triggered ItemImport Script
Severity: High (7.6 out of 10.0 using CVSS v3)
Affected Versions: 7.4 <= 7.6.7, 8.0 <= 8.4, 9.0 <= 9.3, 10.0
Patched Versions: 8.5, 9.4, 10.1
Reported by: @tinyb0y
Fixed by: Tim Donohue
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
When calling the “import” script via the REST API, the “-z” parameter (for zipfile name) is not sanitized. If path traversal characters (e.g. “..”, “/” or “\”) are used in this parameter, it could allow an attacker to write the uploaded import file to an arbitrary directory on any path that is writable by the DSpace backend. This is a path traversal vulnerability that could result in files being overwritten in DSpace configuration, storage, Tomcat directories, or other system directories writable by the DSpace backend. However, this attack can only be triggered by an Administrator because the “import” script can only be run by an Administrator.
GHSA-4ppv-j692-84v9 : EPerson Registration `PATCH` endpoint does not correctly validate registration tokens
Severity: High (7.5 out of 10.0 using CVSS v3)
Affected Versions: 9.0 <= 9.3, 10.0
Patched Versions: 9.4, 10.1
Reported by: @tinyb0y
Fixed by: Tim Donohue
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
When `PATCH` is called on an existing user registration entry, the required token is not verified to be the one assigned to the owner of the registration entry. This means that an unauthenticated user could generate their own token and use it to modify registration entries of other users. In this way, an attacker could nullify open registrations of other users or possibly bind the ORCID of another user to their own DSpace account.
GHSA-qff6-8wrh-2frw : OAI-ORE harvesting fails to validate resource URLs, potentially exposing internal resources as a public bitstream
Severity: High (5.4 out of 10.0 using CVSS v3)
Affected Versions: 1.x.x <= 7.6.7, 8.0 <= 8.4, 9.0 <= 9.3, 10.0
Patched Versions: 8.5, 9.4, 10.1
Reported by: Jozef Misutka, dataquest
Fixed by: Kim Shepherd, 4Science
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
If a DSpace Collection is configured to harvest its content from a remote OAI-ORE source, the harvesting process will fail to validate resource URLs declared by the remote OAI-ORE source. If the OAI-ORE source is untrustworthy or compromised, it could force the DSpace backend to request arbitrary internal HTTP/HTTPs endpoints (even via localhost) during that harvesting process and expose data gathered via DSpace bitstreams. The attacker must be aware of or control a malicious OAI-ORE source. The attacker must also be able to configure a DSpace Collection to harvest from that malicious OAI-ORE source or trick a Collection Administrator into harvesting from that malicious OAI-ORE source.
GHSA-758x-q228-3vqp : Bitstream content requests exposes file information via `accessToken` parameter bypass
Severity: High (5.3 out of 10.0 using CVSS v3)
Affected Versions: 9.0 <= 9.3, 10.0
Patched Versions: 9.4, 10.1
Reported by: @tinyb0y
Fixed by: Kim Shepherd, 4Science
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
The GET/HEAD “/api/core/bitstreams/{uuid}/content” endpoint provides basic Bitstream data to unauthenticated users if an invalid or empty “accessToken” parameter is provided. An unauthenticated attacker can retrieve the exact file size, MD5 checksum, filename, MIME type and last-modified timestamp of any bitstream in the repository (including restricted or withdrawn content) provided they know the UUID. The attacker is unable to access the Bitstream content itself, but is able to gather this basic information about the file via HTTP headers.
GHSA-vrvf-x356-9vhv : Stored XSS via unsanitized item metadata
Severity: High (5.1 out of 10.0 using CVSS v3)
Affected Versions: 10.0
Patched Versions: 10.1
Reported by: Jens Vannerum, Atmire
Fixed by: Jens Vannerum, Atmire
Patches and potential workarounds are available in the security advisory for sites that cannot upgrade immediately.
(NOTE: A CVE ID has been requested but not yet assigned)
In DSpace 10.0, the newly added “dsMetadata” directive does not properly sanitize HTML. This makes it vulnerable to cross-site scripting (XSS) via Item metadata fields. An attacker with submitter privileges could add malicious HTML/Javascript into metadata fields like “dc.description.abstract”. If the Item with the malicious metadata is archived in DSpace, then any other user may accidentally trigger the malicious code just by viewing the Item.
–
We recommend that all DSpace sites immediately apply workarounds, patches or upgrade to 8.5, 9.4 or 10.1. All of these vulnerabilities have been validated via a “proof of concept” attack.
If you have any questions about this security advisory, please email secu...@dspace.org. This email address sends a private email to all DSpace Committers.
Sincerely,
Tim Donohue, on behalf of the DSpace Committers