CVE-2018-11787

Vulnerability

In Apache Karaf versions prior to 3.0.9, 4.0.9, and 4.1.1 [1], the webconsole feature (installed by default) exposes the Gogo shell at /system/console/gogo requiring authentication. However, if the optional Pax Web Extender Whiteboard bundle (part of pax-war feature) is also installed, the Gogo shell becomes accessible at the unsecured URL /gogo/ [2]. This provides unauthenticated users with direct access to the Karaf command-line console [3].

Exploitation

An attacker can exploit this by simply navigating to http://:8181/gogo/ in a browser, provided the Pax Web Extender Whiteboard is installed and the webconsole feature is active [2]. No authentication or user interaction is required. The attacker gains immediate access to the Gogo shell.

Impact

Successful exploitation allows an unauthenticated attacker to execute arbitrary commands on the Karaf container, leading to full compromise of the Karaf instance, including potential reading, modifying, or deleting data, and further lateral movement [1][3]. The severity is rated High (CVSS 7.5) [4].

Mitigation

The vulnerability is fixed in Apache Karaf versions 3.0.9, 4.0.9, and 4.1.1 [4]. Users should upgrade to these versions or later. As a workaround, manually stop or uninstall the Gogo plugin bundle or the Pax Web Extender Whiteboard, though this may reduce functionality [1][3].