com.fasterxml.jackson.core
False positive.
Analysis: This vulnerability is not exposed from the portal’s code, because
- The portal does not pass any untrusted data for deserialization, as there is XSS/XSRF validation enabled in the portal’s backend code.
- and the default typing (ObjectMapper.setDefaultTyping()) is not called as we use concrete java types.
- and we use Spring Security 4.2.3 as recommended in the nexus-iq report.
Spring version 4.2.3 will take care of this.
Comments from Nexus-IQ: Spring Security has provided their own fix for this vulnerability (CVE-2017-4995). If this component is being used as part of Spring Security, then you are not vulnerable if you are running Spring Security 4.2.3.RELEASE or greater for 4.x or Spring Security 5.0.0.M2 or greater for 5.x.Not vulnerable in ONAP
moments
moment 2.1.0
All available versions of moment.js are vulnerable. Upgrade is not an option.
Analysis: Not vulnerable as all our date fields are reformatted and validated before being submitted. See below
CVE 185 information: The moment package is vulnerable to Regular Expression Denial of Service (ReDoS). The monthsShortRegex(),monthsRegex(),weekdaysRegex(),weekdaysShortRegex(), and weekdaysMinRegex() functions in the moment.js, moment-with-locales.js, and regex.js files use a vulnerable regular expression while parsing the date input. A remote attacker can exploit this vulnerability by crafting a date input containing a very long sequence of repetitive characters which, when parsed, consumes available CPU resources and results in Denial Of Service. See JIRA ticket: PORTAL-531
elasticsearch is vulnerable to Information Disclosure. The renderResponse() method in the RestClusterGetSettingsAction class fails to filter certain settings from the ClusterGetSettingsResponse object, and consequently exposes potentially sensitive information via the /_cluster/settings API endpoint. A remote authenticated attacker can exploit this vulnerability by sending a request to the affected cluster endpoint. This will result in the exposure of any sensitive information contained therein. See Jira ticket: PORTAL-532
angular
Analysis: Cannot upgrade angular as this will require changes on all the Portal pages.
From our analysis the vulnerability cannot be exploited because the portal application follows the below design recommendations provided by nexus-iq report.
Recommendation by nexus-iq for this vulnerability (SONATYPE-2016-0064):
It's best to design your application in such a way that users cannot change client-side templates.
- Do not mix client and server templates
- Do not use user input to generate templates dynamically
- Do not run user input through $scope.$eval (or any of the other expression parsing functions listed above)
- Consider using {@link ng.directive:ngCsp CSP} (but don't rely only on CSP)
Not vulnerable in ONAP
angular-sanitize 1.5.0,
Angularjs
AngularJS is vulnerable to Cross-Site Scripting (XSS). The $SanitizeProvider() function in the sanitize.js file doesn't account for user input within the xml:base attribute SVG anchors. A remote attacker can exploit this vulnerability by injecting malicious JavaScript into the xml:baseattribute, which results in script execution when rendered by the browser.
The application is vulnerable by using this component only when enableSvg is enabled, and when using Firefox. By default, the svgEnabled is set to false in 1.5+ versions. See Jira ticket: PORTAL-533
The ui-grid package is susceptible to CSV Macro Injection. The exporter.js file quotes strings in double quotes when exporting to CSV files. An attacker could potentially exploit this behavior by injecting a macro command into a cell in a spreadsheet, having a victim export that spreadsheet as a CSV and loading it into a local copy of Microsoft Excel, at which point the macro can execute arbitrary commands against the victim's computer.
Advisory Deviation Notice: The Sonatype security research team discovered that the vulnerability is present from version 3.0.0-rc.1 onward, and that the attack can take place as described in the associated issue, despite quoting strings on export.
The AngularJS framework is vulnerable to Remote Code Execution (RCE) and Cross-Site Scripting (XSS). The ensureSafeAssignContext() function in parse.js processes malicious expressions that access the constructors. A remote attacker can exploit this vulnerability by crafting malicious expressions that, when processed, result in execution of arbitrary code.
Recommendation
Each version of Angular 1 up to, but not including 1.6, contained an expression sandbox, which reduced the surface area of the vulnerability but never removed it. In Angular 1.6 we removed this sandbox as developers kept relying upon it as a security feature even though it was always possible to access arbitrary JavaScript code if one could control the Angular templates or expressions of applications.
Control of the Angular templates makes applications vulnerable even if there was a completely secure sandbox:
See Jira ticket: PORTAL-533
Should be the same comments as for angular.js. We will perform the upgrade along with angular.js.
All available versions of common-beanutils are vulnerable. Upgrade is not an option.
Analysis: The portal code do not use classloader so it is not vulnerable in ONAP.
CVE CWE: 20
Description from CVE
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
Analysis: Not vulnerable as we do not use POI to read documents. We use only to generate XLS from our own data.
CVE CWE:399:
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
portal,
portal-sdk
The impact of the springframework library is all over the project. So have to be very careful in upgrading the versions.
At least trying to resolve the multiple version use in Dublin -
portal,
portal-sdk
Not clear what is the issue based on the Nexus IQ report information.
See Jira ticket PORTAL-534
Need to upgrade to version 4.1.10.final+
If not false positive, can be handled with the new version upgrade which do not have vulnerability.
Explanation
Apache Commons FileUpload contains a resource leak which may lead to a Denial of Service (DoS) attack.
There is no non vulnerable version of this package.
Explanation
Apache Xerces2 is vulnerable to a Denial of Service (DoS) attack.
portal,
portal-sdk
If not false positive, can be handled with the new version upgrade which do not have vulnerability.
Explanation
Bouncy Castle is vulnerable to Remote Code Execution (RCE).
If not false positive, can be handled with the new version upgrade which do not have vulnerability.
Explanation
Groovy is vulnerable to insecure deserialization leading to Remote Code Execution (RCE).
org.eclipse.jetty
jetty-util
If not false positive, can be handled with the new version upgrade which do not have vulnerability.
Explanation
Eclipse Jetty Server is vulnerable to HTTP request smuggling.
we will try to handle them in Dublin release based on the resource availability and priority;
Will upgrade to 9.2.14.v20151106: or will disable http1.1
portal,
portal-sdk
Not used, this will be removed.
org.apache.tomcat.embed
tomcat-embed-core : 8.5.28:
There is no non vulnerable version of this component/package.
Explanation
Apache Tomcat is vulnerable to a Cross-Origin attack due to the insecure default configuration of the CORS filter.
False positive
We do not use the below code, which is vulnerable.
System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
If not false positive, can be handled with the new version upgrade which do not have vulnerability.
Explanation
The Hibernate Validator (HV) package is vulnerable to a privilege escalation vulnerability.
portal,
portal-sdk
The postgresql package is vulnerable to Man-in-the-Middle (MitM) attacks. When using a non-default SSL Factory, the postgresql jdbc doesn't validate the hostname of SSL certificates. An attacker can potentially exploit this behavior to perform a MitM attack. See Jira ticket: PORTAL-536
Remove this lib. May not be used anymore.
portal,
portal-sdk
The dom4j package is vulnerable to XML Injection. The QName() function in the QName class file does not properly sanitize the QName input attribute value(s). A remote attacker can exploit this vulnerability by injecting an XML object that contains arbitrary code in the element and attribute names, hence leading to XML Injection. See Jira ticket: PORTAL-537
portal,
portal-sdk
Description from CVE
The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.7 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem, and if running on a Java VM before 1.3.1, execute arbitrary code via a crafted serialized Java object.
See Jira ticket: PORTAL-538
Need to upgrade to Apache Wicket 6.25.0
portal,
portal-sdk
The jQuery package is vulnerable to Cross-Site Scripting (XSS). The parseHTML() function in the parseHTML.js, jquery.js files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script. See Jira ticket: PORTAL-539
The jQuery package is vulnerable to Cross-Site Scripting (XSS). The parseHTML() function in the parseHTML.js, jquery.js files allow JavaScript to be executed immediately when it's embedded within the event attributes. An attacker can exploit this vulnerability by injecting malicious JavaScript containing events handlers which, when rendered, results in the execution of arbitrary script. See Jira ticket: PORTAL-540
portal,
portal-sdk
The bootstrap package is vulnerable to Cross-Site Scripting (XSS). The show() function in the tooltip.js file allows HTML and scripts in the data-container tooltip attribute values in the DOM elements without proper sanitization. This can be misused to cause XSS. See Jira ticket: PORTAL-541
portal,
portal-sdk
An attacker can manipulate the cipher transformation (e.g., changing the cipher mode from CBC to OFB or padding scheme) to adverse effect.
portal,
portal-sdk
portal,
portal-sdk
org.owasp.antisamy : antisamy : 1.5.3,
org.owasp.antisamy : antisamy : 1.4.3
AntiSamy is vulnerable to Cross-Site Scripting (XSS). The package uses an HTML serializer that doesn't take HTML5 entities into consideration, such as :, (, and ). An attacker can exploit this to inject JavaScript into the context of the page. See Jira ticket: PORTAL-542
Need to upgrade to version 1.5.7+