Vulnerability DatabaseCVE-2020-17522

CVE-2020-17522:
vulnerability analysis and mitigation

Overview

CVE-2020-17522 is a vulnerability affecting Apache Traffic Control versions 3.0.0 to 3.1.0 and 4.0.0 to 4.1.0. The vulnerability was discovered in the ORT (now via atstccfg) component when generating ip_allow.config files. The issue was publicly disclosed and assigned a CVE ID on August 12, 2020 (CVE MITRE).

Technical details

The vulnerability stems from incorrect permission assignments in the ip_allow.config files generated by the ORT component. This security flaw has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource) (NVD).

Impact

The vulnerability allows malicious actors to push arbitrary content into and remove arbitrary content from CDN cache servers. Furthermore, these permissions can potentially be extended to IP addresses outside the intended range, granting access to clients possibly outside the CDN architecture (NVD).

Exploitability

The vulnerability is exploitable remotely with low attack complexity and requires no privileges or user interaction. The attack vector is network-accessible, making it potentially attractive to remote attackers (NVD).

Mitigation and workarounds

Apache has addressed this vulnerability in subsequent versions after 3.1.0 and 4.1.0. Users are advised to upgrade to the latest version of Apache Traffic Control to mitigate this security issue (Apache Advisory).