CVE-2020-49830: DSpace ORE URI LFI via unvalidated scheme

Vulnerability Summary: Unvalidated Scheme for Non-Web Resources in ORE Resource URI Vulnerability Overview CVE ID: CVE-2020-49830 Severity: Moderate (CVSS v3 score 4.4/10) Description: When aggregating ORE resources via URI using the OAI-ORE Harvester, the ORE Ingestion Crosswalk does not validate the URI scheme. Attackers can exploit this vulnerability to perform Local File Inclusion (LFI) attacks through malicious paths (e.g., ). Affected Versions: 7.6.6, 8.0 < 8.3, 9.0 < 9.2 Fixed Versions: 7.6.7, 8.4, 9.3, 10.0, 9.2 Scope of Impact When a remote OAI endpoint is configured as a harvester for a DSpace collection, a malicious ORE XML can be supplied, causing local files from the DSpace server to be ingested as streams. Only Collection, Community, and Site administrators can configure collections for the OAI harvester, but any administrator can configure the site for local file inclusion, data leakage, or a compressed OAI endpoint. Remediation 1. Recommended Approach: Disable the ORE Crosswalk or upgrade DSpace to one of the fixed versions listed above. 2. Manual Patching (if immediate upgrade is not possible): - Download the patch file for the corresponding version (9.x: #12541, 8.x: #12543, 7.x: #12542) - Apply the patch to the DSpace backend - Rebuild DSpace (e.g., ) - Redeploy DSpace (e.g., ) - Restart Tomcat (or the runnable JAR) POC / Exploit Code After applying the patch or upgrading, the OREIngestionCrosswalk can be safely re-enabled. Additional Information Discovered By: supergeorge2703 (a cybersecurity student at Universidad Rey Juan Carlos) Fix Developer: @kshepherd (The Library Code) Related Standard: CWE-20

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2020-49830: DSpace ORE URI LFI via unvalidated scheme

More from this source