Crowd Security Advisory 2013-07-16

This advisory discloses security vulnerabilities that we have found in standalone Crowd server and fixed in a recent version of Crowd.

• Customers who have downloaded and installed standalone Crowd servers should upgrade their existing Crowd installations to fix this vulnerability.  
• Atlassian OnDemand customers are not affected by any of the issues described in this advisory.
• No type of Crowd deployment other than standalone servers is impacted.

Atlassian is committed to improving product security.

The vulnerability listed in this advisory is a vulnerability in a third party framework - Struts 2 / WebWork 2 that is used by Crowd. The vulnerability has been independently discovered by Atlassian and reported to the Struts maintainers.

More details about the underlying Struts vulnerability CVE-2013-2251 are available at CVE database and in the Struts advisory.

If you have questions or concerns regarding this advisory, please raise a support request at http://support.atlassian.com/.

OGNL injection in WebWork 2

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in Severity Levels for Security Issues. The scale allows us to rank the severity as critical, high, moderate or low.

This is an independent assessment and you should evaluate its applicability to your own IT environment.

Description

We have fixed a vulnerability in WebWork 2, which is a part of the Struts web framework. In specific circumstances, attackers can use this vulnerability to execute Java code of their choice on systems that use these frameworks. In the case of Crowd, the attacker needs to be able to access the Crowd web interface. A valid user account is not required to exploit this vulnerability.

Customers should be advised that this affects all versions of Crowd, except OnDemand, Crowd 2.3.9, Crowd 2.4.10, Crowd 2.5.5 and Crowd 2.6.4 or later. The issue can be tracked here:  CWD-3430 - Getting issue details... STATUS

Risk Mitigation

If you are unable to upgrade or patch your Crowd server: as a temporary workaround, you can do the following:

• Block access to all URLs on a Web Application Firewall or a reverse proxy that contain any of the following strings: "redirect:", "action:" or "redirect-action:" strings. A partial example for an nginx server is below. Note that the example only covers the "redirect:" prefix and does not account for any URL encoding that may be present.

  location ~* ^/<path to your Crowd>/ {
      if ($args ~* "redirect:") {
          return 403;
      }
      proxy_pass http://$host.internal$request_uri;
  }

or

• Block access to your Crowd server's web interface from untrusted networks, such as the Internet.

The vulnerabilities and fix versions are described in the 'Description' section above.

We recommend that you upgrade to the latest version of Crowd, if possible. For a full description of the latest version of Crowd, see the release notes. You can download the latest version of Crowd from the download centre.