Security advisory: Pre-authentication RCE in Ontotext GraphDB 11.4.3 Free edition (Ontotext / Graphwise)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Ontotext GraphDB 11.4.3 Free edition (Ontotext / 
Graphwise). The research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

Ontotext GraphDB 11.4.3 Free edition defaults to security=false, which bypasses the entire Spring Security filter 
chain. As a result, /rest/repositories/ruleset/upload and /repositories/* are anonymously reachable. A .pie ruleset 
upload is compiled at runtime by the system javac and loaded into the server process. RuleCompilerBase.compilePrefices 
inlines the namespace prefix verbatim into the generated Java source with only .trim() and no validation. An attacker 
injects Java code in the prefix; creating a graphdb:Sail repository triggers infer.initialize(), which executes the 
injected Runtime.exec as the GraphDB process user (root). No authentication and no license are required. Dynamically 
verified with uid=0(root).

Impact: Full host compromise as root (the GraphDB process user); the attacker can read any file, execute arbitrary 
commands, and take full control of the GraphDB host and its repositories.

Advisory: https://0day-rubbish.com/blog/graphdb-pie-unicode-escape-unauth-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/