Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-12066

OGNL injection vulnerability

XMLWordPrintable

      We have identified and fixed a vulnerability caused by the way WebWorks/Struts and Freemarker templates are used in Bamboo.

      The vulnerability allows a non-authenticated user to execute arbitrary Java methods in the JVM hosting the Bamboo application. This can be used to execute OS commands as the JVM user.

      All versions of Bamboo up to and including 4.0.1 are affected.

      Full details are available in the advisory at https://confluence.atlassian.com/display/BAMBOO/Bamboo+Security+Advisory+2012-08-28

        1. BAM-12066.zip
          3.87 MB

            [BAM-12066] OGNL injection vulnerability

            Przemek Bruski added a comment -

            David, that's intended. Older versions of Bamboo did not have this dependency and it's required with the latest version of Freemarker. You can replace it or leave it as is, it does not matter.

            Przemek Bruski added a comment - David, that's intended. Older versions of Bamboo did not have this dependency and it's required with the latest version of Freemarker. You can replace it or leave it as is, it does not matter.

            Deleted Account (Inactive) added a comment -

            The Zip file also contains javarebel-sdk-1.2.2.jar, as does my WEB-INF/lib. The two files have identical content, although the date stamps are different.

            Deleted Account (Inactive) added a comment - The Zip file also contains javarebel-sdk-1.2.2.jar, as does my WEB-INF/lib. The two files have identical content, although the date stamps are different.

            VitalyA added a comment - - edited

            If you are using Bamboo 3.0 or later:

            1. Download the BAM-12066.zip file attached to the BAM-12066 issue.
            2. Stop Bamboo.
            3. Make a backup of the <bamboo_install_dir> directory.
            4. Enter WEB-INF/lib directory.
            5. Move the following jar files to a backed up location: freemarker-*.jar, webwork-2.2.7-atlassian-*.jar, xwork-1.2.5-atlassian-*.jar . The zip file contains javarevel jar, if your installation already contains it, you don't have to update it.
            6. Copy the jar files from the zip file you've downloaded to WEB-INF/lib directory.
            7. Start Bamboo.

            VitalyA added a comment - - edited If you are using Bamboo 3.0 or later: Download the BAM-12066.zip file attached to the BAM-12066 issue. Stop Bamboo. Make a backup of the <bamboo_install_dir> directory. Enter WEB-INF/lib directory. Move the following jar files to a backed up location: freemarker-*.jar, webwork-2.2.7-atlassian-*.jar, xwork-1.2.5-atlassian-*.jar . The zip file contains javarevel jar, if your installation already contains it, you don't have to update it. Copy the jar files from the zip file you've downloaded to WEB-INF/lib directory. Start Bamboo.

              vosipov VitalyA
              pbruski Przemek Bruski
              Affected customers:
              0 This affects my team
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: