CVE-2021-39196 (published 2021-09-07T19:15Z)

pcapture is an open source dumpcap web service interface . In affected versions this vulnerability allows an authenticated but unprivileged user to use the REST API to capture and download packets with no capture filter and without adequate permissions. This is important because the capture filters can effectively limit the scope of information that a user can see in the data captures. If no filter is present, then all data on the local network segment where the program is running can be captured and downloaded. v3.12 fixes this problem. There is no workaround, you must upgrade to v3.12 or greater.

Severity: MEDIUM
CVSS v2 base score: 6.8 (AV:N/AC:L/Au:S/C:C/I:N/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Weakness information:
cwe_id: CWE-754
cwe_name: Improper Check for Unusual or Exceptional Conditions
description: The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
extended_description: 
            The programmer may assume that certain events or conditions will never occur or do not need to be worried about, such as low memory conditions, lack of access to resources due to restrictive permissions, or misbehaving clients or components. However, attackers may intentionally trigger these unusual conditions, thus violating the programmer's assumptions, possibly introducing instability, incorrect behavior, or a vulnerability.
            Note that this entry is not exclusively about the use of exceptions and exception handling, which are mechanisms for both checking and handling unusual or unexpected conditions.
         
         

Fix information:
repo_url: https://github.com/jdhwpgmbca/pcapture
commit_details: repo_url: https://github.com/jdhwpgmbca/pcapture
author: James Holmes
author_date: 2021-08-29 21:54:01-05:00
msg: Fixed major security bug.

A user could effectively specify an undefined url and the program would return a null filter rather than throwing an exception and returning an error to the user. This was a really bad bug. I found it when I was adding code to validate the path parameters. That will be coming in the next commit.
repository: repo_url: https://github.com/jdhwpgmbca/pcapture
repo_name: jdhwpgmbca/pcapture
description: Dumpcap web service interface
repo_language: Java
owner: jdhwpgmbca
file_changes: filename: CaptureTypeService.java
change_type: ModificationType.MODIFY
diff: @@ -52,12 +52,16 @@ public class CaptureTypeService
         
         CaptureType type = em.find( CaptureType.class, url_suffix );
         
-        if( type != null )
+        if( type == null )
         {
-            return type.getCaptureFilter();
+            throw new IllegalArgumentException( "The url_suffix must exist in the database." );
         }
         
-        return null;
+        // It is okay for the capture filter itself to be null, but the CaptureType
+        // must be in the database, otherwise the user could effectively forge
+        // a capture filter for "all" just by requesting a non-existent filter.
+        
+        return type.getCaptureFilter();
     }
     
     public CaptureType find( String url_suffix )

programming_language: Java