CVE-2018-18808 : Security Advisory and Response

TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS are affected by a vulnerability that could lead to privilege escalation via a race condition.

Understanding CVE-2018-18808

This CVE involves a domain management component in various TIBCO products that is susceptible to race conditions, potentially enabling users with save privileges to elevate their access to superuser privileges.

What is CVE-2018-18808?

The vulnerability in the domain management component of TIBCO products allows users with specific privileges to gain higher levels of access, posing a significant security risk.

The Impact of CVE-2018-18808

The vulnerability could theoretically enable unauthorized users to obtain system admin access to the JasperReports Server process, potentially leading to unauthorized control and data compromise.

Technical Details of CVE-2018-18808

This section provides detailed technical insights into the vulnerability.

Vulnerability Description

The race-condition vulnerability in the domain management component of TIBCO products allows users with save privileges to potentially escalate their access to superuser privileges.

Affected Systems and Versions

TIBCO JasperReports Server versions 6.3.4, 6.4.0, 6.4.1, 6.4.2, 6.4.3, and 7.1.0
TIBCO JasperReports Server Community Edition versions up to and including 7.1.0
TIBCO JasperReports Server for ActiveMatrix BPM versions up to and including 6.4.3
TIBCO Jaspersoft for AWS with Multi-Tenancy versions up to and including 7.1.0
TIBCO Jaspersoft Reporting and Analytics for AWS versions up to and including 7.1.0

Exploitation Mechanism

The vulnerability arises due to a race condition in the domain management component, allowing users with specific privileges to manipulate the system to gain unauthorized access.

Mitigation and Prevention

To address CVE-2018-18808, follow these mitigation steps:

Immediate Steps to Take

Update TIBCO JasperReports Server versions 6.3.4 and below to version 6.3.5 or higher
Update TIBCO JasperReports Server versions 6.4.0, 6.4.1, 6.4.2, and 6.4.3 to version 6.4.4 or higher
Update TIBCO JasperReports Server version 7.1.0 to version 7.1.1 or higher
Update TIBCO JasperReports Server Community Edition versions 7.1.0 and below to version 7.1.1 or higher
Update TIBCO JasperReports Server for ActiveMatrix BPM versions 6.4.3 and below to version 6.4.4 or higher
Update TIBCO Jaspersoft for AWS with Multi-Tenancy versions 7.1.0 and below to version 7.1.1 or higher
Update TIBCO Jaspersoft Reporting and Analytics for AWS versions 7.1.0 and below to version 7.1.1 or higher

Long-Term Security Practices

Regularly update software to the latest versions to patch known vulnerabilities
Implement least privilege access controls to limit user permissions
Conduct regular security audits and assessments to identify and address potential risks

Patching and Updates

TIBCO has released updated versions of the affected components to resolve the vulnerability. Ensure all affected systems are updated to the recommended software versions to mitigate the risk of privilege escalation.