Container-related datanode operations can be called without authorization

Vulnerability

In Apache Ozone versions prior to 1.2.0, container-related datanode requests are not properly authorized [1][2]. This allows any client to send such requests without authentication, as the authorization checks are missing [2]. The issue affects Ozone datanode components handling container operations.

Exploitation

An attacker with network access to the Ozone datanode can send arbitrary container-related requests without any authentication or prior knowledge. No special privileges are required [2]. The attacker simply crafts a request that should normally be restricted to authorized clients.

Impact

Successful exploitation allows an attacker to perform unauthorized container operations, such as creating, deleting, or modifying containers, potentially leading to data corruption, disclosure, or denial of service [1][2].

Mitigation

Upgrade to Apache Ozone version 1.2.0 or later [2]. No workarounds are documented in the available references.