Arbitrary file deletion on logout

Vulnerability

Apache JSPWiki versions up to and including 2.11.0.M8 contain an arbitrary file deletion vulnerability in the logout functionality. By sending a specially crafted HTTP request during the logout process, a remote attacker can delete files on the server that are reachable by the user account running the JSPWiki instance. The vulnerability affects all JSPWiki deployments prior to version 2.11.0 [1] [3].

Exploitation

An attacker does not need prior authentication; a crafted HTTP request to the logout endpoint is sufficient. The attacker must craft a request that includes a file path parameter pointing to a target file on the server. No user interaction beyond the attacker sending the request is required, and there is no race condition. The attack can be performed remotely over the network [1] [3].

Impact

Successful exploitation allows the attacker to delete arbitrary files on the server filesystem, limited only by the permissions of the user running the JSPWiki instance. This could lead to denial of service, data loss, or potentially assist in further compromise if critical files (e.g., configuration files, application binaries) are removed [1] [3].

Mitigation

Users should upgrade to Apache JSPWiki version 2.11.0 or later, which contains the fix for this vulnerability [1] [3]. The vendor has not disclosed a specific workaround for unpatched installations. There is no indication that this CVE is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the publication date.