Apache Archiva: incorrect authentication potentially leading to account takeover

Vulnerability

Overview

CVE-2024-27139 is an incorrect authorization vulnerability in Apache Archiva, a retired repository manager. Apache Archiva versions 2.0.0 and later are affected. The flaw enables an unauthenticated attacker to modify account data, which can result in full account takeover [1][2].

Root

Cause and Attack Vector

The vulnerability stems from a lack of proper authorization checks on account modification endpoints. An attacker can send crafted requests without authentication to alter sensitive account information, such as passwords or permissions. No user interaction or prior access is required, making the attack vector straightforward for anyone able to reach the Archiva instance [1][2].

Impact and

Severity

Successful exploitation grants an attacker complete control over targeted accounts, including administrative accounts if the attacker targets them. This can lead to unauthorized access to stored artifacts, configuration changes, and potential lateral movement within the network. The severity is rated as important by the Apache security team [2].

Mitigation and

Status

Apache Archiva is a retired project; no official patch will be released. Users are strongly advised to either migrate to an alternative solution or restrict network access to the instance to trusted users only. The vulnerability is classified as "UNSUPPORTED WHEN ASSIGNED" because the product is no longer maintained [1][2].