CVE-2014-8890

Vulnerability

IBM WebSphere Application Server Liberty Profile 8.5.x prior to 8.5.5.4 is vulnerable to a privilege escalation issue. The vulnerability arises when a servlet defines security constraints both in its deployment descriptor (web.xml) and via @ServletSecurity annotations. The conflicting constraints can be exploited to bypass intended access controls, allowing unauthorized access to protected resources [1].

Exploitation

An attacker with remote network access can exploit this vulnerability without prior authentication, though the attack complexity is high (CVSSv2: AV:N/AC:H/Au:N). The attacker must craft a request that triggers the servlet with conflicting security constraints, causing the server to apply a weaker constraint than intended. No special privileges or user interaction are required [1].

Impact

Successful exploitation allows the attacker to gain elevated privileges on the system, potentially leading to partial compromise of confidentiality, integrity, and availability (CVSSv2 base score 5.1). The attacker may access sensitive data, modify resources, or disrupt services within the scope of the affected application [1].

Mitigation

The vulnerability is fixed in IBM WebSphere Application Server Liberty Profile 8.5.5.4. For the Full Profile and Version 8.0, fixes are available in Fix Pack 5 (8.5.5.5) and Fix Pack 11 (8.0.0.11), respectively [1]. As a workaround, administrators can combine the security constraints from both the deployment descriptor and annotations into the web.xml file to eliminate conflicts [1]. No other mitigations are known.