1:30 a.m.
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public (Everyone can see)
Components: Adapters, Rosetta
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:30 a.m.
New subject: [JBoss JIRA] Updated: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=all ]
Martin Vecera updated JBESB-1561:
---------------------------------
Description:
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
was:GroovyActionProcess allows execution of malicious code. This code can be sent via
esb message. See attached example (modified QS).
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:33 a.m.
New subject: [JBoss JIRA] Updated: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=all ]
Jiri Pechanec updated JBESB-1561:
---------------------------------
Attachment: malgroovy.tgz
Attached is modified scripting groovy quickstart. Only modified files were buidl.xml and
jboss-esb.xml. The outcome of runtest target is immediate server down.
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
1:41 a.m.
New subject: [JBoss JIRA] Updated: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=all ]
Martin Vecera updated JBESB-1561:
---------------------------------
Description:
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
was:
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Priority: Critical (was: Major)
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Priority: Critical
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:38 a.m.
New subject: [JBoss JIRA] Assigned: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=all ]
Kevin Conner reassigned JBESB-1561:
-----------------------------------
Assignee: Tom Fennelly
Tom, can you check this out?
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Assigned To: Tom Fennelly
Priority: Critical
Fix For: 4.3, 4.2.1 CP2
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:38 a.m.
New subject: [JBoss JIRA] Updated: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=all ]
Kevin Conner updated JBESB-1561:
--------------------------------
Fix Version/s: 4.2.1 CP2
4.3
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Assigned To: Tom Fennelly
Priority: Critical
Fix For: 4.3, 4.2.1 CP2
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
4:42 a.m.
New subject: [JBoss JIRA] Commented: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=comments#action_12400569 ]
Tom Fennelly commented on JBESB-1561:
-------------------------------------
Sure... from memory I thought there was a config property that needed to be set before
message based scripts could be executed. I guess not then!!
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Assigned To: Tom Fennelly
Priority: Critical
Fix For: 4.3, 4.2.1 CP2
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6:13 a.m.
New subject: [JBoss JIRA] Commented: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=comments#action_12400577 ]
Tom Fennelly commented on JBESB-1561:
-------------------------------------
So this action will only execute message payload based Groovy scripts if there is no
"script" property defined on the action. I'll also add a
"supportMessageBasedScripting" property (default=false) and an explicit
"use with care" comment.
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Assigned To: Tom Fennelly
Priority: Critical
Fix For: 4.3, 4.2.1 CP2
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
8:01 a.m.
New subject: [JBoss JIRA] Commented: (JBESB-1561) Groovy security compromised
[ http://jira.jboss.com/jira/browse/JBESB-1561?page=comments#action_12400588 ]
Jiri Pechanec commented on JBESB-1561:
--------------------------------------
Sounds good as short-term solution but in long term we cannot avoid the SecurityManager
use - if/when there will be release dedicated to security
Groovy security compromised
---------------------------
Key: JBESB-1561
URL: http://jira.jboss.com/jira/browse/JBESB-1561
Project: JBoss ESB
Issue Type: Bug
Security Level: Public(Everyone can see)
Components: Rosetta, Adapters
Affects Versions: 4.2.1 CP1
Reporter: Martin Vecera
Assigned To: Tom Fennelly
Priority: Critical
Fix For: 4.3, 4.2.1 CP2
Attachments: malgroovy.tgz
GroovyActionProcess allows execution of malicious code. This code can be sent via esb
message. See attached example (modified QS).
Credit goes to Jirka Pechanec for this great idea!
Proposed solution: code support for SecurityManager.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://jira.jboss.com/jira/secure/Administrators.jspa
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
6122
days inactive
6122
days old
8 comments
4 participants
participants (4)
-
Jiri Pechanec (JIRA) -
Kevin Conner (JIRA)
-
Martin Vecera (JIRA)
-
Tom Fennelly (JIRA)