[FD] Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext 
GraphDB 11.4.3 Free edition (Ontotext / Graphwise). The research is published 
and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

Ontotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses 
the entire Spring Security filter chain. As a result, 
/rest/repositories/ruleset/upload and /repositories/* are anonymously 
reachable. A .pie ruleset upload is compiled at runtime by the system javac and 
loaded into the server process. RuleCompilerBase.compilePrefices inlines the 
namespace prefix verbatim into the generated Java source with only .trim() and 
no validation. An attacker injects Java code in the prefix; creating a 
graphdb:Sail repository triggers infer.initialize(), which executes the 
injected Runtime.exec as the GraphDB process user (root). No authentication and 
no license are required. Dynamically verified with uid=0(root).

Impact: Full host compromise as root (the GraphDB process user); the attacker 
can read any file, execute arbitrary commands, and take full control of the 
GraphDB host and its repositories.

Advisory: https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/