Metacat
Monthly
Unauthenticated arbitrary file read in NCEAS Metacat (all 1.x and 2.x through 2.19.1) lets a remote attacker retrieve any file readable by the Tomcat process via a path-traversal in the archiveEntryName parameter of the legacy 1.x action=read endpoint. A single unauthenticated GET request can exfiltrate credentials, DataONE client certificates and private keys, and embargoed research data. Publicly available exploit code exists (POC demonstrated and verified); the issue is fixed only in Metacat 3.0.0, and 2.x will not be backported.
Unauthenticated SQL injection in NCEAS Metacat 2.0.0 through pre-3.0.0 allows remote attackers to read, modify, and execute arbitrary statements against the PostgreSQL backend by sending crafted parameters to the /harvesterRegistration endpoint. The flaw stems from string-concatenated INSERTs in HarvesterRegistration.dbInsert() combined with a missing LDAP identity check, and because the backend permits stacked queries via Statement.executeUpdate() the injection escalates to full database compromise. No public exploit identified at time of analysis, but the CVSS 9.8 vector and trivial trigger via three reachable parameters (unit, contactEmail, documentListURL) make exploitation straightforward once the endpoint is reachable.
Unauthenticated information disclosure in NCEAS Metacat versions prior to 3.4.2 allows remote attackers to retrieve internal Apache Solr configuration files such as solrconfig.xml through the client-controlled 'qt' parameter. Because Metacat forwards requests from search endpoints like /d1/mn/v2/query/solr/ to its privileged Solr backend via SolrJ, an attacker can force the /admin/file handler to run even against Solr 7.0+ installations configured with handleSelect=false, and the returned file contents are reflected in an XML error response. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, 5.8), but the impact is limited to configuration and infrastructure profiling rather than code execution or credential theft; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated arbitrary file read in NCEAS Metacat (all 1.x and 2.x through 2.19.1) lets a remote attacker retrieve any file readable by the Tomcat process via a path-traversal in the archiveEntryName parameter of the legacy 1.x action=read endpoint. A single unauthenticated GET request can exfiltrate credentials, DataONE client certificates and private keys, and embargoed research data. Publicly available exploit code exists (POC demonstrated and verified); the issue is fixed only in Metacat 3.0.0, and 2.x will not be backported.
Unauthenticated SQL injection in NCEAS Metacat 2.0.0 through pre-3.0.0 allows remote attackers to read, modify, and execute arbitrary statements against the PostgreSQL backend by sending crafted parameters to the /harvesterRegistration endpoint. The flaw stems from string-concatenated INSERTs in HarvesterRegistration.dbInsert() combined with a missing LDAP identity check, and because the backend permits stacked queries via Statement.executeUpdate() the injection escalates to full database compromise. No public exploit identified at time of analysis, but the CVSS 9.8 vector and trivial trigger via three reachable parameters (unit, contactEmail, documentListURL) make exploitation straightforward once the endpoint is reachable.
Unauthenticated information disclosure in NCEAS Metacat versions prior to 3.4.2 allows remote attackers to retrieve internal Apache Solr configuration files such as solrconfig.xml through the client-controlled 'qt' parameter. Because Metacat forwards requests from search endpoints like /d1/mn/v2/query/solr/ to its privileged Solr backend via SolrJ, an attacker can force the /admin/file handler to run even against Solr 7.0+ installations configured with handleSelect=false, and the returned file contents are reflected in an XML error response. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N, 5.8), but the impact is limited to configuration and infrastructure profiling rather than code execution or credential theft; no public exploit code or active exploitation has been identified at time of analysis.