Original block tokens are persisted and can be retrieved

Vulnerability

In Apache Ozone versions prior to 1.2.0, the initial block tokens generated for data access are persisted to the metadata database. These tokens can be retrieved by any authenticated user who has permission to the associated key. The tokens remain valid and usable even after the user's access to the key has been revoked. This issue is tracked as HDDS-5315 [3].

Exploitation

An attacker must first be an authenticated user with permission to a key in Apache Ozone. Once authenticated, the attacker can retrieve the persisted block tokens from the metadata database for that key. No additional privileges or race conditions are required; the tokens are stored and retrievable through normal API operations [1][3].

Impact

A successful attacker can continue to access the data blocks associated with the key even after their access rights have been revoked. This leads to unauthorized data disclosure or modification, depending on the permissions originally granted. The core impact is a breach of access control, allowing an authenticated user to circumvent token-based security enforcement [1][3].

Mitigation

Upgrade to Apache Ozone version 1.2.0, which resolves the issue. No workarounds have been provided for earlier versions. The vendor credits Marton Elek for reporting the vulnerability [3].