CVE-2019-0191

Vulnerability

Apache Karaf's kar deployer, in all releases prior to 4.2.3, fails to validate path traversal sequences within the repository/ and resources/ entries of .kar archive files. During extraction, the deployer writes content to the filesystem using the unvalidated path from the zip entry, enabling directory traversal with .. components [1][2].

Exploitation

An attacker with the ability to upload a malicious .kar archive to a Karaf instance (e.g., via features service or through an authenticated user triggering deployment) can craft a zip file where entry filenames contain ../ sequences. When the deployer extracts the archive, it writes files to arbitrary locations outside the intended repo and resources directories [1][2]. No additional authentication is required for the deployment action if the attacker has access to the deployer endpoint.

Impact

Successful exploitation allows an attacker to write arbitrary files to the filesystem, potentially leading to overwriting configuration files, deploying malicious artifacts, or achieving code execution depending on the writable paths. The impact is elevated if the Karaf process has broad filesystem permissions; it is considered low if the process user has restricted write capabilities [1]. The vulnerability is classified as a zip-slip attack and can compromise integrity and availability of the system [2].

Mitigation

Upgrade to Apache Karaf version 4.2.3 or later, which validates paths during .kar extraction and rejects entries with traversal components [1][2]. No workaround is documented in the available references. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing.