abraxas/openmeetings-backup-config-pathApache OpenMeetings 9.1.0 - High - Remote - File write leftover - ADMIN_BACKUP import skips Path.of on Type.PATH
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-backup-config-path
Class: File write leftover Reach: Remote
Apache OpenMeetings 9.1.0 (9773c59e) - Apache Software Foundation
CVE-2023-29246 closed NUL injection on Admin Config Type.PATH via Path.of. BackupImport.importConfigs still writes those rows with no Path.of. An ADMIN_BACKUP restore stores a raw converter path. On Java 21, ProcessBuilder also rejects NUL, so this is the leftover of the 29246 sink, not a new argv RCE.
| ID | no CVE yet |
| Class | File write leftover (leftover of CVE-2023-29246) |
| Reach | Remote (authenticated ADMIN_BACKUP restore) |
| CWE | CWE-20, CWE-22 |
| CVSS | High: 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
| Product | Apache OpenMeetings |
| Affected | 9.1.0 (9773c59e1af327bf988018e661f456ae9997c29f) backup import |
| Auth | ADMIN_BACKUP (installer admin has it) |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18160 only. apache/openmeetings:min-9.1.0 plus Temurin 21. |
I pinned tag 9.1.0. No NUL payload. No ffmpeg exec.
Hold ADMIN_BACKUP (installer admin, or a planted backup admin). Restore a backup zip whose configs set imagemagick_path / ffmpeg to an arbitrary string.
| Method | Sink | Privilege |
|---|---|---|
admin.sh -r / Wicket backup restore | BackupImport.importConfigs cfgDao.update Type.PATH, no Path.of | Integrity (lab-proven): configuration.path.imagemagick and path.ffmpeg stored as PATH /tmp/OPENMEETINGS-BACKUP-CONFIG-PATH-WITNESS. |
| Later conversion jobs (inferred) | imagemagick/ffmpeg/sox/office argv from those rows | Integrity / availability (inferred): converter pointed at an attacker path. Java 21 ProcessBuilder still rejects NUL. Not exercised. |
Lab-proven vs inferred: stored Type.PATH witness string is lab. Converter exec is inferred. NUL argv RCE is closed on this JDK (InvalidPathException Nul character not allowed on Path.of; ProcessBuilder also rejects NUL).
Control: Path.of accepts this Unix witness path. The leftover is the missing check on import, not a Path.of bypass of a normal Unix path. UI ConfigForm still uses Path.of.
Requires: ADMIN_BACKUP. A restore. Wicket /admin/backup/upload with a REST SID returned access denied (needs the websocket Client SID). The lab used admin.sh -r, same BackupImport.performImport.
| Surface | Why |
|---|---|
| Admin Config UI PATH keys | Path.of (ConfigForm). NUL throws. |
| NUL in ProcessBuilder on Java 21 | rejected. CVE-2023-29246 RCE does not replay on this JDK. |
| ROOM / LOGIN restore | no ADMIN_BACKUP. |
29246 patched the UI. I grepped importConfigs for Path.of. The remap imagemagick_path → path.imagemagick forces Type.PATH and updates the DAO. Same class the UI uses after a restore.
cd lab
./run.sh
Loopback https://127.0.0.1:18160/openmeetings. Witness last line:
SUCCESS OPENMEETINGS-BACKUP-CONFIG-PATH-WITNESS
Run the same Path.of / Type.PATH validator in BackupImport.importConfigs that ConfigForm uses. Reject NUL and non-canonical converter paths before cfgDao.update.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]