Title: CVE-2018-18809 Path traversal in Tibco JasperSoft
Credit: Elar Lang / https://security.elarlang.eu
Vendor/Product: Tibco JasperSoft (https://www.jaspersoft.com/)
Vulnerability: Path traversal
# Path traversal
Vulnerability is in reportresource/reportresource/ service and in resource
parameter. There is "defence" - value for resource param must start with
Available for remote not authenticated users.
Reading file listing:
Reading file content (js.jdbc.properties as an example):
# List of Systems Affected, Related fixes and releases:
"TIBCO Security Advisory: March 6, 2019 - TIBCO JasperReports Library -
# Vulnerability Disclosure Timeline
2018-10-15 | me > Tibco | Notification to email@example.com
2018-10-15 | Tibco > me | Thanks for PoC
2018-10-29 | me > Tibco | How is going? No fixes even for their own site.
2018-10-15 | Tibco > me | Explanation of policy that they threat everyone
equally and as no fix available for their customer, they can not fix their
own site also.
2019-01-11 | Tibco > me | Issue is still under investigation. Issue
discovery credits and publishing details coordination for future.
2019-01-11 | me > Tibco | Response, agreement with credits.
2019-03-06 | Tibco > me | "We published security advisories"
2019-03-06 | Tibco | "TIBCO Security Advisory: March 6, 2019 - TIBCO
JasperReports Library - 2018-18809"
2019-04-21 | me > Tibco | I'm going to write Full Disclosure, but your own
demo site is still vulnerable.
2019-04-26 | Tibco > me | Demo site fixed/updated now.
2019-09-07 | me | Full Disclosure on https://security.elarlang.eu
# More detailed description is available in blog:
Blog @ https://security.elarlang.eu
Pentester, lecturer @ http://www.clarifiedsecurity.com