Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

Overview

A flaw was found in WildFly. A user with the Monitor role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the Monitor role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure.

Affected

• pki-core:10.6/resteasy
• pki-deps:10.6/resteasy
• resteasy
• wildfly-cli (all versions)
• wildfly-controller (all versions)
• wildfly-controller-client (all versions)
• wildfly-core-galleon-pack (all versions)
• wildfly-core-management-client (all versions)
• wildfly-core-management-subsystem (all versions)
• wildfly-core-security
• wildfly-core-security-api (all versions)
• wildfly-deployment-repository (all versions)
• wildfly-deployment-scanner (all versions)
• wildfly-discovery (all versions)
• wildfly-domain-http-error-context (all versions)
• wildfly-domain-http-interface (all versions)
• wildfly-domain-management (all versions)
• wildfly-elytron-integration (all versions)
• wildfly-elytron-tool-wrapper (all versions)
• wildfly-embedded (all versions)
• wildfly-event-logger (all versions)
• wildfly-host-controller (all versions)
• wildfly-io (all versions)
• wildfly-jmx (all versions)
• wildfly-launcher (all versions)
• wildfly-logging (all versions)
• wildfly-management-client-content (all versions)
• wildfly-model-test (all versions)
• wildfly-network (all versions)
• wildfly-patching (all versions)
• wildfly-platform-mbean (all versions)
• wildfly-process-controller (all versions)
• wildfly-protocol (all versions)
• wildfly-remoting (all versions)
• wildfly-request-controller (all versions)
• wildfly-security-manager (all versions)
• wildfly-self-contained (all versions)
• wildfly-server (all versions)
• wildfly-subsystem-test-framework (all versions)
• wildfly-threads (all versions)
• wildfly-version (all versions)
• jboss-eap-7/eap74-els-openjdk11-openshift-rhel8 (all versions)
• jboss-eap-7/eap74-els-openjdk17-openshift-rhel8 (all versions)
• jboss-eap-7/eap74-els-openjdk8-openshift-rhel8 (all versions)
• wildfly-cli (all versions)
• wildfly-controller (all versions)
• wildfly-controller-client (all versions)
• wildfly-core-build (all versions)
• wildfly-core-build-legacy (all versions)
• wildfly-core-component-matrix-builder (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

To mitigate this issue, restrict access to the WildFly management interface to trusted networks and users. Implement firewall rules to limit network reachability to the management ports. Additionally, review existing Role-Based Access Control (RBAC) assignments within WildFly and ensure that users are granted only the minimum necessary privileges, adhering to the principle of least privilege. Reviewing role assignments might impact functionality if users genuinely require the Monitor role for their operations.