CVE-2018-11786

Vulnerability

In Apache Karaf all versions prior to 4.2.0.M1 (and the 4.2.0 release), the sshd service, when left enabled for administrative management, allows any user with Karaf console rights to pivot and read/write any file on the file system that the Karaf process user can access. The issue is a lack of proper RBAC enforcement for file system operations through the console [1][3].

Exploitation

An attacker needs SSH access to the Karaf instance and privileges to use the Karaf console. With these, they can execute commands via the console that perform arbitrary file reads and writes, bypassing intended restrictions. The console does not enforce access controls to limit file operations beyond the Karaf home directory [1][3].

Impact

Successful exploitation allows an attacker to read or write any file accessible by the Karaf process user. This can lead to information disclosure, modification of configuration or application files, and potentially privilege escalation depending on the process's permissions [1][4].

Mitigation

Apache Karaf users should upgrade to version 4.2.0.M1 or later, which includes fixes for RBAC enforcement [2][3]. Workarounds such as using chroot or a security manager policy can partially reduce the risk but are not fully effective [1][3]. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.