Access mode of block tokens are not enforced

Vulnerability

In Apache Ozone versions prior to 1.2.0, the Ozone Datanode fails to check the access mode parameter of the block token. This allows an authenticated user who possesses a valid READ block token to perform any write operation on the same block. The issue is tracked as HDDS-4558 and HDDS-4644. [2][3]

Exploitation

An attacker must be an authenticated user with a valid READ block token for a specific block. No additional privileges or user interaction beyond authentication are required. The attacker can then issue write operations (e.g., modify or overwrite data) on that block by exploiting the missing access mode enforcement in the Datanode. [2][3]

Impact

Successful exploitation enables an attacker to write arbitrary data to a block for which they only have a READ token. This compromises the integrity and availability of data, as the attacker can corrupt or modify stored objects. Confidentiality is not directly affected. The privilege level is that of an authenticated user with a valid token. [1][2][3]

Mitigation

The vulnerability is fixed in Apache Ozone version 1.2.0, released on 2021-11-19. Users should upgrade to this version or later. No workarounds are documented in the available references. [3]