CVE-2023-3629

Overview

Infinispan is an open-source in-memory data grid and distributed key/value data store. Java applications embed it as a local or clustered cache through infinispan-core, or connect to a cluster of Infinispan Server nodes through the Java Hot Rod client, infinispan-client-hotrod. Its modules are published to Maven Central under org.infinispan, and Spring Boot 2.7 manages the Infinispan 13.0 BOM.

An information exposure vulnerability (CVE-2023-3629) has been identified in the REST endpoint of Infinispan Server, which allows any authenticated user to retrieve the full configuration of a cache without holding the administrator permission that the operation requires. The affected module, infinispan-server-rest, runs inside Infinispan Server; applications that only embed infinispan-core or connect through the Hot Rod client do not normally ship it.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects multiple versions of Infinispan.

Details

Module Info

• Product: Infinispan
• Affected packages: org.infinispan:infinispan-server-rest
• Affected versions: <14.0.18.Final, >=15.0.0.Dev01 <15.0.0.Dev04
• GitHub repository: https://github.com/infinispan/infinispan
• Published packages: https://central.sonatype.com/artifact/org.infinispan/infinispan-server-rest
• Package manager: Maven
• Fixed in:
  • OSS Infinispan 14.0.18.Final, 15.0.0.Dev04
  • NES for Infinispan v13.0.24

Vulnerability Info

This Medium-severity vulnerability is found in the org.infinispan:infinispan-server-rest package in multiple versions of Infinispan. The REST server's CacheResourceV2 registers the cache configuration and cache detail endpoints without any permission requirement, unlike neighboring administrative actions such as ?action=get-mutable-attributes, which require AuthorizationPermission.ADMIN:

.invocation().methods(GET, HEAD).path("/v2/caches/{cacheName}").withAction("config").handleWith(this::getCacheConfig)
...
.invocation().methods(GET).path("/v2/caches/{cacheName}").handleWith(this::getAllDetails)

Both handlers then read the cache's configuration through SecurityActions.getCacheConfiguration, which wraps the lookup in doPrivileged and so bypasses the cache's own authorization checks:

private CompletionStage<RestResponse> getCacheConfig(RestRequest request) {
   ...
   Configuration cacheConfiguration = SecurityActions.getCacheConfiguration(cache.getAdvancedCache());

   ByteArrayOutputStream entity = new ByteArrayOutputStream();
   try (ConfigurationWriter writer = ConfigurationWriter.to(entity).withType(accept).prettyPrint(false).build()) {
      parserRegistry.serialize(writer, cacheName, cacheConfiguration);
   }
   ...
}

private RestResponse getDetailResponse(Cache<?, ?> cache) {
   Configuration configuration = SecurityActions.getCacheConfiguration(cache.getAdvancedCache());
   ...
   invocationHelper.getParserRegistry().serialize(w, cache.getName(), configuration);
   fullDetail.configuration = sw.toString();
   ...
}

As a result, any user who can authenticate to the REST API and open a cache can send GET /rest/v2/caches/<name>?action=config, or a plain GET /rest/v2/caches/<name>, and receive the complete serialized cache configuration, including persistence, security, cross-site backup and other settings that are meant to be visible only to administrators.

Mitigation

Infinispan's security policy lists only its current release lines as supported for vulnerability updates, and upstream has made no 13.0.x release since 13.0.22.Final (April 2024), so no 13.0.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a currently supported release of Infinispan that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.