Apache Archiva: disabling user registration is not effective

Vulnerability

Overview

CVE-2024-27138 describes an incorrect authorization vulnerability in Apache Archiva, a retired repository manager. The application includes a configuration option intended to disable new user registration, but this restriction can be bypassed by an attacker. The root cause is a flaw in the authorization logic that fails to properly enforce the registration setting when processing certain requests.

Exploitation

Exploitation requires network access to an Archiva instance. The attacker does not need prior authentication; they can directly abuse the bypass to register a new account. The vulnerability exists in the user registration endpoint, which does not correctly check whether registration is disabled before creating an account. This enables any remote, unauthenticated user to create an account on the system.

Impact

By successfully registering an account, an attacker gains access to the Archiva repository with at least the privileges of a standard user. Depending on the instance's configuration, this could allow them to view, upload, or modify artifacts, potentially leading to supply chain attacks or disclosure of sensitive data. The vulnerability is rated as moderate severity because the attacker does not gain administrative privileges solely from registration.

Mitigation

Apache Archiva has been retired and no longer receives security updates; the Apache Software Foundation confirmed they will not release a patch. Administrators should migrate to an alternative solution, such as Apache Maven or modern artifact repositories. If migration is not immediately possible, Archiva instances must be isolated from untrusted users, for example by placing them behind a firewall or VPN. This vulnerability is listed as 'Unsupported When Assigned' by the CVE program [1][2].