CVE-2015-9287
📋 TL;DR
CVE-2015-9287 is a directory traversal vulnerability in University of Cambridge's mod_ucam_webauth authentication module where attackers can manipulate the unsigned 'kid' field in WLS-Response messages to load RSA public keys from arbitrary locations. This allows authentication bypass and potential remote code execution. Organizations using mod_ucam_webauth for web authentication are affected.
💻 Affected Systems
- University of Cambridge mod_ucam_webauth
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete authentication bypass leading to unauthorized access to protected systems, potential remote code execution, and full compromise of affected servers.
Likely Case
Authentication bypass allowing unauthorized access to protected web applications and services using mod_ucam_webauth.
If Mitigated
Limited impact with proper network segmentation and monitoring, but authentication bypass remains possible.
🎯 Exploit Status
Exploitation is straightforward as the 'kid' field is unsigned and can be manipulated without authentication. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2
Vendor Advisory: https://github.com/grymer/CVE
Restart Required: Yes
Instructions:
1. Download mod_ucam_webauth version 2.0.2 or later from official sources. 2. Replace existing mod_ucam_webauth module files with patched version. 3. Restart Apache web server to load the updated module.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to reject non-integer values in the 'kid' field
# Example mod_rewrite rule for Apache
RewriteCond %{QUERY_STRING} kid=[^0-9] [OR]
RewriteCond %{REQUEST_BODY} kid=[^0-9]
RewriteRule ^.*$ - [F]
🧯 If You Can't Patch
- Implement strict network segmentation to isolate systems using mod_ucam_webauth
- Deploy web application firewall with rules to detect and block manipulation of the 'kid' parameter
🔍 How to Verify
Check if Vulnerable:
Check mod_ucam_webauth version: grep -r 'mod_ucam_webauth' /etc/apache2/ or check Apache module list. If version is below 2.0.2, system is vulnerable.Check Version:
apache2ctl -M 2>/dev/null | grep ucam_webauth && grep -r 'VERSION\|version' /usr/lib*/apache2/mod_ucam_webauth* 2>/dev/nullVerify Fix Applied:
Verify mod_ucam_webauth version is 2.0.2 or higher and test authentication with manipulated 'kid' values to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with unusual 'kid' parameter values
- Access logs showing directory traversal patterns in requests
Network Indicators:
- HTTP requests containing non-integer 'kid' parameters
- Unusual file path patterns in authentication requests
SIEM Query:
source="apache_access" AND (kid="*[^0-9]*" OR kid="*../*")