May 2024

Denial-of-Service (DoS) in Login Page


Description

In the login page, it is possible to send specially crafted parameters to cause the page to subsequently trigger an error : 

NullPointerExceptions e.g.:

```
Caused by: java.lang.NullPointerException
    at org.joget.commons.spring.web.ParameterizedAnnotationMethodHandlerAdapter$ParameterizedPathServletRequest.getParameterNames(ParameterizedAnnotationMethodHandlerAdapter.java:84) ~[wflow-commons-8.0-SNAPSHOT.jar:?]
    at org.glowroot.agent.plugin.servlet.DetailCapture_.captureRequestParameters(DetailCapture.java:71) ~[?:?]
    at org.glowroot.agent.plugin.servlet.RequestParameterAspect$GetParameterAdvice_.captureRequestParameters(RequestParameterAspect.java:61) ~[?:?]
    at org.glowroot.agent.plugin.servlet.RequestParameterAspect$GetParameterAdvice_.onReturn(RequestParameterAspect.java:54) ~[?:?]
    at javax.servlet.ServletRequestWrapper.getParameterMap(ServletRequestWrapper.java:157) ~[servlet-api.jar:4.0.FR]
    at org.joget.commons.spring.web.ParameterizedAnnotationMethodHandlerAdapter$ParameterizedPathServletRequest.setAttribute(ParameterizedAnnotationMethodHandlerAdapter.java:96) ~[wflow-commons-8.0-SNAPSHOT.jar:?]
    at org.joget.commons.spring.web.ParameterizedAnnotationMethodHandlerAdapter$ParameterizedPathServletRequest.<init>(ParameterizedAnnotationMethodHandlerAdapter.java:62) ~[wflow-commons-8.0-SNAPSHOT.jar:?]
```



Once triggered, the login page will become inaccessible and the web application server needs to be restarted to restore access.

Severity

High

Affected Versions

Joget DX 8.0.12 and below

Resolution

Upgrade to Joget DX 8.1.0 and above



March 2024

Reflected Cross-Site Scripting Vulnerability (XSS) in Userview

Description

In a userview, it is possible to send unvalidated data to a web browser when dynamically switching user locales, which can result in the browser executing malicious code.

Severity

High

Affected Versions

Joget DX 8.0.11 and below

Resolution

Upgrade to Joget DX 8.0.12 and above


April 2022

Critical Vulnerability in Spring Framework CVE-2022-22965

Description

A critical vulnerability has been found in the Spring Framework. According to the vulnerability report CVE-2022-22965:

A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

These are the prerequisites for the exploit:

  • JDK 9 or higher
  • Apache Tomcat as the Servlet container
  • Packaged as WAR
  • spring-webmvc or spring-webflux dependency

Affected Joget Versions

  • Joget DX (7.0.27 and below) running on JDK 9+ and Apache Tomcat (8.5.77 and below, or 9.0.61 and below).
  • Joget Workflow v6 (6.0.34 and below) running on JDK 9+ and Apache Tomcat (8.5.77 and below, or 9.0.61 and below)

Resolution

A fix is available in the latest Joget versions:

  • Joget DX 7.0.28
  • Joget Workflow v6 6.0.35

Workarounds

If you are not able to upgrade to the latest Joget versions yet, please perform either one of the following workarounds:

  • Upgrade to Apache Tomcat 8.5.78 or 9.0.62, or
  • Downgrade to Java 8, or
  • Disable the AccessLogValve in Tomcat's server.xml configuration. Edit /conf/server.xml and remove/comment the tag <Valve className="org.apache.catalina.valves.AccessLogValve" .. />


December 2021

Critical Vulnerability in Apache Log4j CVE-2021-44228

Description

Critical vulnerability in Apache Log4j. According to the report CVE-2021-44228:

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Affected Joget Versions

The following versions use Apache Log4j 1.x:

  • Joget DX 7.0.25 and below
  • Joget Workflow v6 (all versions)

However, this vulnerability only affects Apache Log4j versions from 2.0-beta9 to 2.14.1, so they are NOT affected by this vulnerability.

Resolution

To upgrade to the latest log4j 2 version, upgrade to the following Joget versions:

  • Joget DX 7.0.26 and above


  • No labels