Missing authentication/authorization on internal RPC endpoints

Vulnerability

In Apache Ozone versions prior to 1.2.0, various internal server-to-server RPC endpoints are exposed without proper authentication or authorization [1][3]. This affects communication between Datanodes and the Ozone Manager, as well as endpoints involved in Ratis replication configuration [3]. The code paths are reachable by any network entity that can connect to these internal RPC ports [1].

Exploitation

An attacker with network access to the internal RPC ports can connect to these unprotected endpoints [1][3]. No authentication or prior privileges are required [3]. The attacker can issue requests to download raw data from Datanodes and the Ozone Manager, or modify the Ratis replication configuration [1][3].

Impact

Successful exploitation allows an attacker to download raw data from Datanodes and the Ozone Manager, leading to unauthorized information disclosure [1][3]. Additionally, the attacker can modify the Ratis replication configuration, potentially affecting data redundancy and consistency [1][3]. The impact is a breach of confidentiality and integrity of the storage system [1][3].

Mitigation

Apache has released version 1.2.0 of Ozone, which fixes this issue [3]. Users should upgrade to Apache Ozone 1.2.0 or later [3]. No workarounds are mentioned in the available references.