Apache Archiva Cross Site Request Forgery Vulnerability

Bugtraq ID:	45095
Class:	Design Error
CVE:	CVE-2010-3449
Remote:	Yes
Local:	No
Published:	Nov 30 2010 12:00AM
Updated:	Feb 10 2011 04:19PM
Credit:	Anatolia Security Research Group
Vulnerable:	Apache Software Foundation Continuum Data Management 1.2.3.1 Apache Software Foundation Continuum 1.4 Apache Software Foundation Continuum 1.3.6 Apache Software Foundation Continuum 1.0.2 Apache Archiva 1.3.1 Apache Archiva 1.2.2 Apache Archiva 1.1.4 Apache Archiva 1.0.3 Apache Archiva 1.3 Apache Archiva 1.2 Apache Archiva 1.1 Apache Archiva 1.0
Not Vulnerable:	Apache Software Foundation Continuum 1.3.7 Apache Archiva 1.3.2

Apache Archiva Cross Site Request Forgery Vulnerability

Apache Archiva is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

The following versions are affected:

Archiva versions 1.0 through 1.0.3
Archiva versions 1.1 through 1.1.4
Archiva versions 1.2 through 1.2.2
Archiva versions 1.3 through 1.3.1

Apache Archiva Cross Site Request Forgery Vulnerability

To exploit this issue, an attacker must entice an unsuspecting victim to open a malicious URI.

The following proof-of-concept is available:

• /data/vulnerabilities/exploits/45095.html

Apache Archiva Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the reference for more details.

Apache Archiva Cross Site Request Forgery Vulnerability

References:

• Archiva Homepage (Apache)
  
• Archiva Security (Apache)
  
• Continuum Security Vulnerabilities (Apache Software Foundation)
  
• CSRF vulnerability - Archiva doesn't check which form sends credentials (Codehaus)
  
• Release Notes for Archiva 1.3.2 (Apache)
  
• [SECURITY] CVE-2010-3449: Apache Continuum CSRF vulnerability (Brett Porter )
  
• Anatolia Security Advisory (Anatolia Security)