EPrints Technical Mailing List Archive

See the EPrints wiki for instructions on how to join this mailing list and related information.

Message: #10435

< Previous (by date) | Next (by date) > | < Previous (in thread) | Next (in thread) > | Messages - Most Recent First | Threads - Most Recent First

[EP-tech] IMPORTANT - Security updates to all version of EPrints

Hi all,

*** This affects all version of EPrints 3.4 and versions of 3.3 and possibly earlier ***

Recently, we have discovered three potential security exploits on EPrints for which we have produced security advisories (see below).  All three require you to have an authenticated user account. They also all relate to read-only access to files local to the server or its network, when you otherwise would not have access.  However, It would require either a brute force attempt or some specific knowledge of the server/network to access most files, assuming they do not have any additional protections in place.

1. Authenticated server-side file read via symlink in Compressed archive import  - https://github.com/eprints/eprints3.4/security/advisories/GHSA-3746-gx5r-j7g5

This allows an authenticated user to upload a zip file or similar that contains a symlink that points at a file outside the scope of the zip file's contents.  If this file exists on the server it may be uploaded to the eprint record and be visible to the user who uploaded the zip file.  Please see the link above for advice on how to mitigate or patch this exploit.

2. Upload from URL deposit hands an unvalidated URL to wget - https://github.com/eprints/eprints3.4/security/advisories/GHSA-w4m7-r88p-54xc

This allows an authenticated user to upload a file based on what the server hosting the EPrints repository can see rather than what the user can see.  This may allow files on a local intranet or link local address to be accessed by the user, when otherwise they might not have access. Please see the link above for advice on how to mitigate or patch this exploit.

3. XML Imports allow XML eXternal Entity (XXE) Injection - https://github.com/eprints/eprints3.4/security/advisories/GHSA-h5v5-3x49-wf4g

This allows an authenticated user to import some XML (e.g. some EP3XML), which contains an entity that references a local file on the server.  When the XML is imported to create the eprint record this entity is expanded and replaced with the contents of the file. Please see the link above for advice on how to mitigate or patch this exploit.

Patches for 1 and 3 should allow you to retain the same functionality prior to applying them but the patch for 2 will remove the option to upload files by URL for an eprint record.  You could re-enable this but you are recommended to configure a validation of these URLs to ensure you restrict anything that could be used to access files the user should not be able to see.

Patch 3 is quite large as it removes a lot of pre-packaged XML libraries.  These should now be installed by your operating system package manager or CPAN, so you get the latest version.  Patch 3 also standardises on the XML::LibXML library, so you can no longer use one of the XML::GDOME or XML::DOM libraries instead.

I have tested the patch files for all three of these security advisories on a recent version of EPrints and I was able to successfully apply them.  The earlier a version of EPrints 3.4 that you are running, the greater the chance these patch files will not work, particularly the patch file for 3.  If necessary, it should be possible to produce patch files for specific versions of EPrints 3.4.  For quick reference the following link should allow you to download all three patch files and would be where version specific patches file will be uploaded if necessary:

https://files.eprints.org/3333/

I have requested some CVEs through GitHub but they have yet to be issued.  I will update the title of the above link to include the CVEs once they are issued.

Regards

David Newman