Nuclos remoting security: CVE-2016-1000027, Java RMI, HttpInvoker, remote code execution, SECURITY_IP_ALLOW_REMOTING, java-rmi.enabled.

globe with meridians Language: Deutsch · English

light bulb Remoting

Security notice about the remoting interface – CVE-2016-1000027, mitigations and the switch to JSON from 4.2023.8.

Auf dieser Seite

In all Nuclos versions up to 4.2023.7 the remoting interface (used by the rich client) is vulnerable. An update to 4.2023.8 is strongly recommended.

Cause

Communication with the rich client ran via Java RMI/Spring HttpInvoker over HTTP(S). Via CVE-2016-1000027 Java deserialization allows remote code execution: anyone with access to the remoting interface can send crafted requests and run code as a subprocess of the server. All URLs matching */remoting/* are affected.

Mitigations for versions ≤ 4.2023.7

Version 4.2023.8

From this version a fully JSON-based remoting interface is available. Java RMI is disabled by default but can be re-enabled with remoting.java-rmi.enabled=true in server.properties (reset by the installer).

Related pages

gear Security parameters


IP filter.

Öffnen →

gear Running Nuclos behind a reverse proxy


Proxy.

Öffnen →