Raw block data can be read bypassing ACL/authorization

Vulnerability

In Apache Ozone versions prior to 1.2.0, a vulnerability exists in the block access handling. Authenticated users who know the ID of an existing block can craft specific requests to access those blocks, bypassing other security checks like ACLs [1][2]. This issue is tracked as HDDS-5061 [2].

Exploitation

An attacker must be an authenticated user of the Apache Ozone instance and possess knowledge of a target block's ID. With this information, the attacker can craft a request that directly accesses the block data, circumventing the ACL validation that would normally restrict access [1][2].

Impact

Successful exploitation allows the attacker to read raw block data without proper authorization, leading to unauthorized information disclosure. The attacker gains access to data that should have been protected by ACLs, potentially exposing sensitive information stored in those blocks [1][2].

Mitigation

Apache Ozone released version 1.2.0 which fixes this vulnerability. Users should upgrade to Apache Ozone 1.2.0 or later [2]. No workaround is mentioned in the available references.