Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
8 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A path traversal vulnerability is possible via the COAR Notify / LDN service in DSpace. This vulnerability impacts DSpace versions 8.0 <= 8.3, 9.0 <= 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. When reading a file input stream of an "inbound pattern" / "template", used to generate an LDN message, the LDN class does not check for path traversal or restrict the templates to a known base path. This could allow an untrusted file from elsewhere in the file system (e.g. an export log, a bitstream path, a temporary file) to be read and interpreted as an Apache Velocity template. Expected behaviour : Only the trusted templates kept in $dspace.dir/config/ldn should be allowed or used by LDN. Impact On its own this seems a fairly low-impact problem: only DSpace Administrators can set LDN template names in services, and you typically need more access to manipulate files on the server. However, this vulnerability was included as…
Recommended action: Upgrade to 10.0, 9.3 or 8.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
When ingesting an aggregated ORE resource by URI (using the OAI-ORE Harvester)), the ORE Ingestion Crosswalk does not validate the URI scheme. This may allow for local file inclusion via malicious paths like file:///etc/passwd. This vulnerability impacts DSpace versions <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2. The attacker MUST already have DSpace collection administrator privileges in order to perform the attack. Expected behaviour : Only external web resources should be ingested as ORE resources, preferably from the trusted endpoint. Impact A remote OAI endpoint configured as a harvest source for a DSpace collection can supply malicious ORE XML that results in a local file from the DSpace server being ingested as a bitstream. Only Collection, Community and Site Administrators can configure a collection for OAI harvest, however an attacker may use stolen credentials to escalate into local file/data disclosure, or a compromised OAI endpoint could also supply malicious XML. Patches…
Recommended action: Upgrade to 10.0, 9.3, 8.4 or 7.6.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Curation Task feature allows an output path to be used by the reporter (-r parameter), typically used to stream results and status of curation task operations. It is not restricted to any particular base path, meaning that any path writable by the DSpace (often 'tomcat') user is allowed. This constitutes a Path Traversal Vulnerability in the curate script. This was not a real problem when curation tasks could only be run from the command-line as a system administrator, but now that Collection/Community/Site Administrators can also run curation tasks via the web user interface, it introduces a possibility for an attacker with DSpace administrative credentials to set command parameters in such a way that output ends up in an unexpected location (for example, static resources folder in the Spring boot webapp, or overwriting a configuration file). This vulnerability impacts DSpace versions <= 7.6.6, 8.0 <= 8.3, 9.0 <= 9.2. The attacker MUST already have DSpace…
Recommended action: Upgrade to 10.0, 9.3, 8.4 or 7.6.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Remote Code Execution (RCE) is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This vulnerability impacts DSpace versions 8.0 <= 8.3, 9.0 <= 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. This attack is related to the path traversal attack identified in GHSA-9qm4-rh6w-pq5x as it was the impactful part of the "proof-of-concept" attack chain. Impact When chained with the LDN Path Traversal Attack identified in GHSA-9qm4-rh6w-pq5x, it may be possible to execute Java directly from Velocity templates using reflection. This is a very high impact vulnerability, but the attack can only be performed by a user that has DSpace Administrator privileges. Disabling LDN (see below) removes all known attack paths. Velocity is also used for email templating, but there is no known attack path via emails templates. Nonetheless, the patches below also apply to email templates. Patches The fix is included in…
Recommended action: Upgrade to 10.0, 9.3 or 8.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A path traversal vulnerability is possible during the import of an archive (in Simple Archive Format), either from command-line (./dspace import command) or from the "Batch Import (Zip)" user interface feature. This vulnerability likely impacts all versions of DSpace 1.x <= 7.6.3, 8.0 <= 8.1, and 9.0. An attacker may craft a malicious Simple Archive Format (SAF) package where the contents file references any system files (using relative traversal sequences) which are readable by the Tomcat user. If such a package is imported, this will result in sensitive content disclose, including retrieving arbitrary files or configurations from the server where DSpace is running. The Simple Archive Format (SAF) importer / Batch Import (Zip) is only usable by site administrators (from user interface / REST API) or system administrators (from command-line). Therefore, to exploit this vulnerability, the malicious payload would have to be provided by an attacker and trusted by an administrator…
Recommended action: Upgrade to 9.1, 8.2 or 7.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Two related XXE injection possibilities have been discovered, impacting all versions of DSpace prior to 7.6.4, 8.2 and 9.1. 1. External entities are not disabled when parsing XML files during import of an archive (in Simple Archive Format), either from command-line (./dspace import command) or from the "Batch Import (Zip)" user interface feature. (Likely impacts all versions of DSpace 1.x <= 7.6.3, 8.0 <= 8.1, and 9.0) 2. External entities are also not explicitly disabled when parsing XML responses from some upstream services (ArXiv, Crossref, OpenAIRE, Creative Commons) used in import from external sources via the user interface or REST API. (Impacts all versions of DSpace 7.0 <= 7.6.3, 8.0 <= 8.1 and 9.0) An XXE injection in these files may result in a connection being made to an attacker's site or a local path readable by the Tomcat user, with content potentially being injected into a metadata field. In the latter case, this may result in sensitive content disclosure,…
Recommended action: Upgrade to 9.1, 8.2 or 7.6.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact ItemImportServiceImpl is vulnerable to a path traversal vulnerability. This means a malicious SAF (simple archive format) package could cause a file/directory to be created anywhere the Tomcat/DSpace user can write to on the server. However, this path traversal vulnerability is only possible by a user with special privileges (either Administrators or someone with command-line access to the server). This vulnerability impacts the XMLUI, JSPUI and command-line. This vulnerability does NOT impact 7.x. Patches DSpace 6.x: Fixed in 6.4 via commit: https://github.com/DSpace/DSpace/commit/7af52a0883a9dbc475cf3001f04ed11b24c8a4c0 6.x patch file: https://github.com/DSpace/DSpace/commit/7af52a0883a9dbc475cf3001f04ed11b24c8a4c0.patch (may be applied manually if an immediate upgrade to 6.4 or 7.x is not possible) DSpace 5.x: Fixed in 5.11 via commit: https://github.com/DSpace/DSpace/commit/56e76049185bbd87c994128a9d77735ad7af0199 5.x patch file:…
Recommended action: Upgrade to 6.4 or 5.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only existed in 7.0 and does not impact 6.x or below. Patches Fix is included in 7.1. Please upgrade to 7.1 at your earliest convenience. Workarounds In 7.0, temporarily disable the ability for community or collection administrators to manage permissions or workflows settings, i.e. set the following properties in your local.cfg / dspace.cfg file Once upgraded to 7.1, these settings can be safely reverted to the default values of true. References Discovered during investigation of https://github.com/DSpace/DSpace/issues/7928 For more information If you have any questions or comments about this advisory: Email us at security@dspace.org
Recommended action: Upgrade to 7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.