Grouper Users - Open Discussion List

[Andrew Morgan <>]

The alert script displays on my Grouper instance when I'm not logged in. 
In the background (under the pop-up), I see the Grouper error page which 
says, "Click here to start over."  This is the usual error page I see when 
my session has expired.  In this case, I deleted my Grouper cookies before 
attempting this.

        Andy




On Mon, 23 Jul 2018, Scott Koranda wrote:

> Hi,
>
> Does exploiting the vulnerability require authenticated access to the
> Grouper UI?
>
> Thanks,
>
> Scott K
>
> > There is an XSRF security vulnerability in the Grouper UI.
> >
> > Grouper v2.2 and v2.3 are affected.
> >
> > The patches for this have no dependencies (i.e. you don't have to install 
> > other patches) and are low risk lightweight patches, so you should apply 
> > these asap.
> >
> > https://bugs.internet2.edu/jira/browse/GRP-1838
> >
> > 2.2: grouper_v2_2_2_ui_patch_6
> > 2.3: grouper_v2_3_0_ui_patch_45
> >
> > There are patches for 2.2.2 and 2.3.0.  Note, if you are using 2.2.0 or 
> > 2.2.1, you can still unzip that patch and manually apply it in the classes 
> > dir and it should work.  If the java version of the patch does not match what 
> > you are running we can recompile the source for your version.
> >
> > Thanks to Jerry Lee, Information Security Analyst, University of Auckland, 
> > for finding this and clearly describing it to the team.
> >
> > Reproduce this by appending this to your URL:
> >
> > /grouperExternal/public/UiV2Public.index?operation=UiV2Public.postIndex&function=UiV2Public.error&code=%3Cscript%3Ealert(1)%3C/script%3E
> >
> > e.g.
> >
> > https://grouperdemo.internet2.edu/grouper_v2_2/grouperExternal/public/UiV2Public.index?operation=UiV2Public.postIndex&function=UiV2Public.error&code=%3Cscript%3Ealert(1)%3C/script%3E
> >
> > If the vulnerability exists, you will see this:
> >
> > [https://bugs.internet2.edu/jira/secure/attachment/15871/15871_image-2018-07-20-13-14-40-882.png]
> >
> > If the patch is applied and the vulnerability is fixed, you will see this:
> >
> > [https://bugs.internet2.edu/jira/secure/attachment/15872/15872_image-2018-07-20-13-46-52-199.png]
> >
> >
> > Let me know if you have any questions.
> >
> > Thanks
> > Chris
> >
> > Ps. Here is what I just did for Penn (in test and prod):
> >
> >
> > 1.       Verify exists:
> >
> > https://grouper.apps.upenn.edu/grouper/grouperExternal/public/UiV2Public.index?operation=UiV2Public.postIndex&function=UiV2Public.error&code=%3Cscript%3Ealert(1)%3C/script%3E
> >
> >
> > 2.       Install patch
> >
> > [appadmin@fastprod-mgmt-01 patching]$ more run.sh
> > #!/bin/bash
> >
> > export JAVA_HOME=/opt/appserv/common/java
> > export PATH=$JAVA_HOME/bin:$PATH
> > cd /opt/appserv/tomcat/apps/grouper/patching
> > java -cp .:grouperInstaller.jar 
> > edu.internet2.middleware.grouperInstaller.GrouperInstaller
> > echo
> > echo "run this to complete the patching"
> > echo 'clusterRun grouper "rm -rf /opt/appserv/tomcat/apps/grouper/work/*"'
> > echo "clusterCopy.sh grouper /opt/appserv/tomcat/apps/grouper/webapps/grouper"
> > echo "clusterTomcat grouper restart"
> > [appadmin@fastprod-mgmt-01 patching]$ ./run.sh
> > Do you want to 'install' a new installation of grouper, 'upgrade' an existing 
> > installation,
> >   'patch' an existing installation, 'admin' utilities, or 'createPatch' for 
> > Grouper developers
> >   (enter: 'install', 'upgrade', 'patch', 'admin', 'createPatch' or blank for 
> > the default) [patch]:
> > Enter in a Grouper temp directory to download tarballs (note: better if no 
> > spaces or special chars) 
> > [/opt/appserv/tomcat/letters/tomcat_2v/patching/tarballs]:
> > What do you want to patch?  api, ui, ws, pspng, or psp? [UI]:
> > Where is the grouper UI installed? 
> > [/opt/appserv/tomcat/apps/grouper/webapps/grouper]:
> > What do you want to do with patches (install, revert, status, fixIndexFile)? 
> > [install]:
> > Do you want to fix the patch index file (download all patches and see if they 
> > are installed?) (not recommended) (t|f)? [f]:
> >
> > Would you like to install all patches (t|f)? [t]:
> > f
> > Would you like to install patches up to a certain patch level? (t|f)? [f]:
> >
> > Would you like to install certain specified patches? (t|f)? [f]:
> > t
> > What patches would you like to install [comma-separated] (e.g. 
> > grouper_v2_3_0_api_patch_0, grouper_v2_3_0_api_patch_1, 
> > grouper_v2_3_0_ui_patch_0)? :
> > grouper_v2_3_0_ui_patch_45
> >
> >
> > ################ Checking patch grouper_v2_3_0_ui_patch_45
> > Downloading from URL: 
> > http://software.internet2.edu/grouper/release/2.3.0/patches/grouper_v2_3_0_ui_patch_45.tar.gz
> >  to file: 
> > /opt/appserv/tomcat/letters/tomcat_2v/patching/tarballs/patches/grouper_v2_3_0_ui_patch_45.tar.gz
> > Unzipping: 
> > /opt/appserv/tomcat/letters/tomcat_2v/patching/tarballs/patches/grouper_v2_3_0_ui_patch_45.tar.gz
> > Expanding: 
> > /opt/appserv/tomcat/letters/tomcat_2v/patching/tarballs/patches/grouper_v2_3_0_ui_patch_45.tar
> >  to 
> > /opt/appserv/tomcat/letters/tomcat_2v/patching/tarballs/patches/grouper_v2_3_0_ui_patch_45
> > Patch grouper_v2_3_0_ui_patch_45 is low risk, is a security patch
> > GRP-1838: xsrf problem with /UiV2Public.index
> > - added to end of property file: grouper_v2_3_0_ui_patch_45.date = 2018/07/20 
> > 14:44:49
> > This patch requires all processes that user Grouper to be stopped.
> >   Please stop these processes if they are running and press <enter> to 
> > continue...
> >
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$5.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$6.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$2.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$1.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$3.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$4.class
> > Applying file: 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.java
> > Patch successfully applied: grouper_v2_3_0_ui_patch_45
> > - added to end of property file: grouper_v2_3_0_ui_patch_45.state = applied
> >
> > [appadmin@fastprod-mgmt-01 patching]$ clusterCopy.sh grouper 
> > /opt/appserv/tomcat/apps/grouper/webapps/grouper
> > COPY TO SERVER fastprod-medium-a-01: 
> > /opt/appserv/local/tomcat/letters/tomcat_2v/webapps/grouper 
> > /opt/appserv/local/tomcat/letters/tomcat_2v/webapps
> > sending incremental file list
> > grouper/WEB-INF/grouperPatchStatus.properties
> > grouper/WEB-INF/classes/
> > grouper/WEB-INF/classes/grouper-loader.properties~
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$1.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$2.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$3.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$4.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$5.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer$6.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.class
> > grouper/WEB-INF/classes/edu/internet2/middleware/grouper/grouperUi/beans/ui/TextContainer.java
> >
> > sent 78534 bytes  received 734 bytes  31707.20 bytes/sec
> > total size is 120040994  speedup is 1514.37
> >
> > Complete copy.sh on servers: fastprod-medium-a-01 fastprod-medium-a-02 
> > fastprod-medium-a-03 fastprod-medium-a-04 fastprod-medium-a-05: 
> > /opt/appserv/local/tomcat/letters/tomcat_2v/webapps/grouper 
> > /opt/appserv/local/tomcat/letters/tomcat_2v/webapps
> > [appadmin@fastprod-mgmt-01 patching]$ clusterTomcat grouper restart
> > SERVER fastprod-medium-a-01: /sbin/service tomcat_grouper restart
> > SERVER fastprod-medium-a-02: /sbin/service tomcat_grouper restart
> > SERVER fastprod-medium-a-03: /sbin/service tomcat_grouper restart
> > SERVER fastprod-medium-a-04: /sbin/service tomcat_grouper restart
> > SERVER fastprod-medium-a-05: /sbin/service tomcat_grouper restart
> > SUCCESS: grouper
> > [appadmin@fastprod-mgmt-01 patching]$
> >
> >
> > 3.       Verify fixed