abraxas/openmeetings-cluster-openjpaApache OpenMeetings 9.1.0 - High - Remote - CWE-502 - clustering OpenJPA RemoteCommitProvider TCP 5636
abraxaslabs.tech · github.com/abraxas · @abraxas_null · [email protected] · openmeetings-cluster-openjpa
Class: CWE-502 Reach: Remote
Apache OpenMeetings 9.1.0. Leftover of CVE-2024-54676 (docs whitelist). Default bin/startup.sh does not set OpenJPA lists. Clustering.xml / systemd unit still document RemoteCommitProvider=tcp. When an admin uncomments that, TCP 5636 is unfiltered ObjectInputStream.readObject. Stock 9.1.0 does not bind 5636.
This lab sends java.util.HashMap / String only. No gadget chain.
| ID | no CVE yet |
| Class | CWE-502 |
| Reach | Remote (when clustering TCP is enabled as docs) |
| CWE | CWE-502 |
| CVSS | High: 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Product | Apache OpenMeetings 9.1.0 clustering |
| Auth | none on 5636 once clustering is on |
| License | GNU Affero GPL v3.0 |
| Lab | 127.0.0.1:18162 only |
| Method | Sink | Privilege |
|---|---|---|
| Stock default TCP 5636 | startup.sh has no lists; persistence.xml commented | Closed on stock (lab-proven): port closed. PHASE_A_STOCK_NOT_EXPLOITABLE. |
Docs-on RemoteCommitProvider=tcp then TCP 5636 serialized HashMap | OpenJPA readObject | Integrity (lab-proven deserialize): ClassCastException HashMap vs RemoteCommitEvent. Witness string was in the HashMap. Gadget RCE not exercised. |
Closed: ysoserial not used. Default clustering off. CVE-2024-54676 docs whitelist for the script path; this leftover is the TCP provider the clustering doc still shows.
cd lab
./run.sh
Last line: SUCCESS OPENMEETINGS-CLUSTER-OPENJPA-WITNESS
Suggested fix: keep RemoteCommitProvider off. If TCP clustering is required, bind loopback and set the OpenJPA serialization whitelist in startup.sh, not only systemd. Do not document uncomment-and-listen on 5636.
Abraxas Labs - https://abraxaslabs.tech - https://github.com/abraxas - https://x.com/abraxas_null - [email protected]
Vendor: [email protected]