-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.apache.geode:geode-web | maven | >= 1.10.0, < 1.15.2 | 1.15.2 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability described is a Cross-Site Request Forgery (CSRF) in the Apache Geode Management and Monitoring REST API. The provided commit 570990909e6fd1e491f01471ad30ee3c2dbff72c directly addresses this issue. The patch modifies the ShellCommandsController.java file, specifically changing the @RequestMapping annotation for the command method. Previously, the endpoint /management/commands accepted both GET and POST requests. The patch removes RequestMethod.GET, restricting the endpoint to only RequestMethod.POST. This is a standard and effective mitigation for CSRF vulnerabilities, as it prevents attackers from executing commands through malicious URLs that trigger GET requests. Therefore, the command function within the ShellCommandsController is the vulnerable function, as it was the entry point for the CSRF attack.
org.apache.geode.management.internal.web.controllers.ShellCommandsController.commandgeode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java