Eclipse Arrowhead
Monthly
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory.
Authorization bypass in Eclipse Arrowhead 5.0.0-5.2.1 allows any authenticated system - regardless of privilege level - to reach every protected management API endpoint by submitting percent-encoded paths that defeat the raw-URL substring check while still being routed by Spring MVC's decoded dispatcher. Exploiting the flaw is trivial: encoding a single character in '/mgmt/' (e.g. 'm' → '%6D') causes the filter to fall through without authorizing the request, yet Tomcat decodes and dispatches it normally. The highest-impact target is POST /authentication/mgmt/identities, which creates new sysop-level accounts, yielding full administrative takeover of the Arrowhead local cloud. No public exploit has been identified at time of analysis.
Authentication bypass in Eclipse Arrowhead 5.0.0 through 5.2.1 lets an unauthenticated attacker who can publish to the MQTT broker impersonate the cloud's system operator. When the MQTT API runs with the certificate authentication policy, CertificateMqttFilter reads an X.509 certificate straight from the MQTT message payload and trusts its Subject DN without ever verifying the signature or issuer chain, reducing authorization to two string comparisons on public, attacker-controlled values. By minting a self-signed certificate with CN=Sysop.<cloud>.<org>.arrowhead.eu and dnQualifier=op, the attacker gains isSysOp==true and full management access. No public exploit is identified at time of analysis, but the technique is described in full detail in the advisory.