Highest Description
The RESTCONF request URI with encoded forward slash (/) returns the status code of 400 and the request is not processed.
For example,
{
"servlet": "org.glassfish.jersey.servlet.ServletContainer",
"message": "Invalid request",
"url": "/rests/data/network-topology:network-topology/topology=topology-netconf/node=XPDR-A1/yang-ext:mount/org-openroadm-device:org-openroadm-device/circuit-packs=1%2F0%2F1-PLUG-NET",
"status": "400"
}
This appears to be caused by Shiro 0.12.1 adopted by AAA. The version addresses a path traversal attack (CVE-2023-34478) by rejecting URIs with an encoded forward slash.
Attachments
| # | Subject | Branch | Project | Status | CR | V |
|---|---|---|---|---|---|---|
| 107790,5 | Skip tests in failure before deps version bump | master | transportpce | Status: MERGED | +2 | +1 |
| 107888,4 | Disable invalidRequest.blockTraversal | master | aaa | Status: MERGED | +2 | +1 |
| 107900,1 | Disable invalidRequest.blockTraversal | 0.17.x | aaa | Status: MERGED | +2 | +1 |
| 107901,1 | Disable invalidRequest.blockTraversal | 0.16.x | aaa | Status: MERGED | +2 | +1 |
| 107945,1 | Reactivate disabled functional tests | master | transportpce | Status: MERGED | +2 | +1 |
