SonarQube Authentication Bypass Vulnerability Allowing Unauthorized Project Manipulation

An authentication bypass vulnerability has been identified in SonarQube version 8.4.2.36762. This issue allows external attackers to exploit SonarScanner by leaving the -D sonar.login option empty, which forces anonymous authentication. As a result, attackers can create and overwrite both public and private projects using the /api/ce/submit endpoint. This vulnerability arises from a default configuration that unintentionally exposes project management capabilities to unauthenticated users.

Impact

Exploitation of this vulnerability allows for unauthorized creation and modification of projects, both public and private, potentially leading to injection of malicious code into the development process.

Reproduction

To reproduce this vulnerability, first ensure that SonarQube version 8.4.2.36762 is running. Then, use SonarScanner with the -D sonar.login option set to an empty value. This will authenticate the user as 'anonymous', bypassing any authentication requirements. Once authenticated, projects can be created or overwritten using the /api/ce/submit endpoint. This can be done by uploading a ZIP file containing the project analysis report, which can include injected code.

Remediation

Users are advised to update to a version of SonarQube that addresses this vulnerability. Consult the SonarQube release notes or documentation for guidance on updating.