vendor:
Mule ESB Runtime
by:
Volatile Minds
8.8
CVSS
HIGH
Authenticated Privilege Escalation
287
CWE
Product Name: Mule ESB Runtime
Affected Version From: 3.5.2001
Affected Version To: 3.5.2001
Patch Exists: NO
Related CWE: N/A
CPE: a:mulesoft:mule_esb_runtime:3.5.1
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2015
Mulesoft ESB Runtime 3.5.1 Authenticated Privilege Escalation ? Remote Code Execution
Mulesoft ESB Runtime 3.5.1 allows any arbitrary authenticated user to create an administrator user due to a lack of permissions check in the handler/securityService.rpc endpoint. The following HTTP request can be made by any authenticated user, even those with a single role of Monitor. This request will create an administrator with all roles with a username of notadmin and a password of notpassword. Many vectors of remote code execution are available to an administrator. Not only can an administrator deploy WAR applications, they can also evaluate arbitrary groovy scripts via the web interface.
Mitigation:
Ensure that all users have the appropriate permissions and roles assigned to them.
