Full Report
Apache Allura is used by many popular products. It is a site that managers source code, bug reports, discussions and many other things. SourceForge uses this under the hood. Within the discussion area, users can import/export arbitrary files. Even though it should only ever be a URL, the file:// URI can be used. The file is added to the file locally, giving both an arbitrary file read and SSRF in one bug. Using this, it's possible to read /etc/passwd. However, we can do better than that! Allura contains a global session key used to sign the sessions, which are pickle serialized. By reading the configuration file, it's possible to steal the key! Since we can now sign the pickle serialized files, we get trivial code execution. I think the remediation is interesting. First (and most obvious) the URL is checked to be either http/https. Additionally, there are SSRF checks to ensure that it's not a local IP. Second, the pickle session storage was replaced with a JWT implementation to prevent RCE via this ever again. Overall, a simple bug leads to RCE in a popular thing.
Analysis Summary
# Vulnerability: Arbitrary File Read leading to Remote Code Execution via Discussion Import in Apache Allura
## CVE Details
- CVE ID: CVE-2023-46851
- CVSS Score: Not explicitly given, but described as "critical," implying a high score (Likely 9.0+ due to RCE).
- CWE: Not explicitly listed (Involves Improper Input Validation leading to Path Traversal/SSRF and Deserialization of Untrusted Data).
## Affected Systems
- Products: Apache Allura (Used by SourceForge)
- Versions: 1.15.0 and earlier.
- Configurations: Affects projects utilizing the Discussion tool where users can import/export files.
## Vulnerability Description
The vulnerability exists in the file import/export feature within the Discussion tool of Apache Allura. When importing files, the system improperly handles content supplied via URIs. An attacker can supply a `file://` URI instead of the expected `http(s)` URL, leading to an Arbitrary File Read (AFR) vulnerability, often combined with Server-Side Request Forgery (SSRF).
This AFR allows an attacker to read local configuration files, specifically the file containing the global session key used to sign pickle-serialized sessions. By stealing this key, the attacker can forge/sign malicious pickle serialized session data, achieving trivial Remote Code Execution (RCE) on the server.
## Exploitation
- Status: Not exploited in the wild (SourceForge reacted promptly). PoC implied by the research findings.
- Complexity: Low (Requires user interaction within the affected component, but leads directly to RCE).
- Attack Vector: Network (via crafting a malicious import request).
## Impact
- Confidentiality: High (Ability to read sensitive configuration files, including the session signing key).
- Integrity: Critical (Gained RCE allows modification/deletion of data and code execution).
- Availability: Critical (RCE grants full system compromise).
## Remediation
### Patches
- **Apache Allura version 1.16.0** and later contains the fix.
### Workarounds
1. **Feature Disablement:** SourceForge promptly disabled the affected import/export feature upon reporting.
2. **Configuration Change:** While not explicitly listed as an applied workaround before the patch, the remediation logic checks ensure only `http/https` URLs are processed and includes SSRF checks against internal IP addresses.
## Detection
- **Indicators of Compromise (IoCs):** Attempts to import files using non-HTTP/HTTPS URI schemes (`file://`, custom protocols, etc.) within the Discussion import endpoint. Attempts to read sensitive configuration files via network logs related to the import feature.
- **Detection Methods and Tools:** Web Application Firewalls (WAFs) or network monitoring tools configured to inspect request bodies destined for the import handler, flagging unusual URI schemes or attempts to resolve private IP addresses during SSRF checks.
## References
- Vendor Advisories: Sonar Blog Post (April 16, 2024)
- Relevant Links: hxxps://www.sonarsource.com/blog/dangerous-import-sourceforge-patches-critical-code-vulnerability/
- Allura Fix Commit: hxxps://github.com/apache/allura/commit/9be8b315669dff59979fbd258037c8aaadaf6d26 (Showing replacement of pickle sessions with JWTs).