Knowage Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Knowage versions through 8.1.26. The issue arises from the use of an unsafe 'org.apache.commons.jxpath.JXPathContext' in the 'MetaService.java' file, allowing a normal user to execute commands on the server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server where Knowage is running.

Reproduction

To reproduce this vulnerability, clone the Knowage-Server-Docker repository and start it using Docker Compose. Log in with a normal user account and obtain the session ID. After creating a model for the current session, send a request to the 'checkRelationships' endpoint, including a crafted 'diff' payload that executes a command, such as creating a file in the '/tmp' directory. Finally, verify that the command was executed by checking for the presence of the created file in the container.

Remediation

Users can upgrade to Knowage version 8.1.27 or 8.2.0 to address this vulnerability.