CVE-2014-5393 Path Traversal to Sensitive Files in Webroot in "JobScheduler"

2014-10-1500:00:00

vulners.com

JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

CVE-2014-5393

"Path Traversal to Sensitive Files in Webroot" (CWE-219) vulnerability in "JobScheduler" product

Vendor

Software- & Organisations-Service GmbH

Product

"JobScheduler is a workload automation tool. It is used to launch JobScheduler objects,
such as jobs and/or orders, at the occurrence of time, file or calendar events. JobScheduler
was recognised in 2012 by Gartner Inc. with a placement in their Magic Quadrant for workload
automation. JobScheduler provides solutions from simple to complex scheduling scenarios.
It is available with an open source or a commercial licence."

source: http://www.sos-berlin.com/modules/cjaycontent/index.php?id=osource_scheduler_introduction_en.htm

Affected versions

This vulnerability affects versions of JobScheduler prior to 1.7.4241
as well as versions prior to 1.6.4246.

Patch

The vendor has released patches for versions 1.7.x and 1.6.x at
http://www.sos-berlin.com/modules/news/article.php?storyid=73
http://www.sos-berlin.com/modules/news/article.php?storyid=74

Reported by

This issue was reported to the vendor by Christian Schneider (@cschneider4711)
following a responsible disclosure process.

Severity

High

Description

Using specially crafted requests to access the web interface of JobScheduler it is possible
as an underprivileged user ("info" permission) to list directories and read contents of
(sensitive) files from the installation of the JobScheduler web interface, which includes
datasource configurations (for example hibernate.cfg.xml and sos_settings.ini) as well
as permission config files (scheduler.xml). These can include passwords, depending on
which auth backend was defined. This can also be misused to escalate to the higher "all"
permission from the lower "info" permission.