Casablanca APPC Security/Vulnerability Report

org.codehaus.jackson

No Action Required

No Action Required

There is no non vulnerable version of this component.

False Positive

    Explaination: This vulnerability issue only exists if com.fasterxml.jackson.databind.ObjectMapper.setDefaultTyping() is called before it is used for deserialization.

appc doesn't invoke this method, and a concrete java type is explicitly specified when deserializing the JSON objects, so this vulnerability issue has no impact on appc.

https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization

com.fasterxml.jackson.core

org.onap.dmaap.messagerouter.dmaapclient has the 5 security vulnerabilities , out of these 4 security issues are related to the com.att.nsa:dmaapclient and another is related to the Jackson-core.jar, which we can’t fix as all the versions are vulnerable. DMaaP client is not using the jackson-core.jar, in such a way that it will cause the vulnerability.  a ticket #54030 with the LF by dmaap team. Please refer the following link for more details.

It comes with org.onap.ccsdk.sli.core:dblib-provider:jar, org.opendaylight.controller:opendaylight-karaf-empty

Apache karaf is vulnerable to Improper Access Control. Multiple functions in SessionFactoryImpl, SecuredCommand and SecuredSessionFactoryImpl class files process and execute the external commands without checking the scope of the input commands. This may allow an attacker to read from, or write to any file on the filesystem to which the Karaf process user has access.

com.fasterxml.jackson.core

False Positive

Explanation

The Apache httpcomponents component is vulnerable to Directory Traversal. The normalizePath() function in the URIBuilder class allows directory traversal characters such as ../. An attacker can exploit this vulnerability by sending a specially crafted request containing this sequence in the URL path, allowing the attacker to traverse beyond the allowed directory and retrieve the contents of arbitrary files from the server, leading to information disclosure.

Detection

The application is vulnerable by using this component.

We investigated from mvn tree output. Found out this jar only included in test purpose. Please see the tree dependency below:

org.apache.maven.wagon:wagon-http:jar:2.10:test

[INFO] |  +- org.opendaylight.odlparent:karaf-util:jar:3.1.3:test

[INFO] |  |  \- org.apache.maven.wagon:wagon-http:jar:2.10:test

[INFO] |  |     +- org.apache.maven.wagon:wagon-http-shared:jar:2.10:test

[INFO] |  |     |  +- org.jsoup:jsoup:jar:1.7.2:test

[INFO] |  |     |  \- commons-lang:commons-lang:jar:2.6:test

[INFO] |  |     +- org.apache.httpcomponents:httpclient:jar:4.3.5:test

[INFO] |  |     |  \- commons-codec:commons-codec:jar:1.11:test

[INFO] |  |     +- org.apache.httpcomponents:httpcore:jar:4.3.2:test

[INFO] |  |     \- org.apache.maven.wagon:wagon-provider-api:jar:2.10:test

[INFO] |  |        \- org.codehaus.plexus:plexus-utils:jar:3.0.15:test

**request CDP-PAL to fix

False Positve

The dom4j package is vulnerable to XML Injection. The QName() function in the QName class file does not properly sanitize the QName input attribute value(s). A remote attacker can exploit this vulnerability by injecting an XML object that contains arbitrary code in the element and attribute names, hence leading to XML Injection.

However QName.Qname class not used by APPC code. Appc code only uses QName.localName

False Positive

only occurred in appc-test-dependencies. This APPC: appc-test-dependencies package is only used during junit/mockito test.

False Postive

library is contained in cdp-pal libraary.

ONAP is not using Windows envrionment.

False Positve

this package comes with javax:javaee-api:jar:7.0

JavaMail is vulnerable to Information Exposure. The getUniqueMessageIDValue() method in the UniqueValue class file appends the username and the hostname of the Java process when generating the Message-Id for an email. This can lead to unintended information leakage in the email headers and potentially lead to security issues.

However UniqueValue class not used by APPC code. 

False Positive

this package comes with com.datastax.cassandra:cassandra-driver-core:jar:3.0.8

The netty-handler package is vulnerable to Improper Certificate Validation. The OpenSsl class and the setSSLParameters() method in the ReferenceCountedOpenSslEngine class do not validate hostnames of SSL certificates. An attacker can exploit this vulnerability by executing a Man-in-the-Middle (MitM) attack in order to intercept requests and provide a valid attacker-controlled certificate to the client. This allows the attacker to decrypt, read, and modify data in transit, thus effectively spoofing the vulnerable server.
Detection

The application is vulnerable by using the OpenSSL feature of this this component.

appc/cdt

False Positive

Explanation

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

Detection

The application is vulnerable by using this component, when default typing is enabled and passing in untrusted data to be deserialization.

appc codes below does not use createBeanDeserializer()

https://gerrit.onap.org/r/gitweb?p=appc/cdt.git;a=blob;f=CdtProxyService/src/main/java/org/onap/appc/cdt/service/MainApplication.java;h=c1605196866286a02a6a3fc6f71009e6f37ab8c5;hb=refs/heads/master

False Positive

Explanation

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

Detection

The application is vulnerable by using this component, when default typing is enabled and passing in untrusted data to be deserialization.

appc codes below does not use createBeanDeserializer()

appc/deployment

com.github.fonimus

False Positive

Explanation

jackson-databind is vulnerable to Remote Code Execution (RCE). The createBeanDeserializer() function in the BeanDeserializerFactory class allows untrusted Java objects to be deserialized. A remote attacker can exploit this by uploading a malicious serialized object that will result in RCE if the application attempts to deserialize it.

Note: This vulnerability exists due to the incomplete fix for CVE-2017-7525, CVE-2017-15095, CVE-2017-17485, CVE-2018-5968, and CVE-2018-7489. Evidence of this can be found at https://pivotal.io/security/cve-2017-4995:

appc codes below does not use createBeanDeserializer()

https://gerrit.onap.org/r/gitweb?p=appc/cdt.git;a=blob;f=CdtProxyService/src/main/java/org/onap/appc/cdt/service/MainApplication.java;h=c1605196866286a02a6a3fc6f71009e6f37ab8c5;hb=refs/heads/master

AAF addresses: AAF R3 Casablanca Security/Vulnerability Threat

AAF addresses: AAF R3 (Casablanca) Security/Vulnerability Threat