Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability

Vulnerability

Overview

CVE-2022-44644 affects Apache Linkis versions up to and including 1.3.0 when used with the MySQL Connector/J in the data source module. The root cause is that the JDBC URL parameters are not properly blacklisted, allowing an authenticated attacker to set allowLoadLocalInfile=true. This enables the MySQL client to read arbitrary local files from the Linkis server when connecting to a rogue MySQL server [2].

Exploitation

An attacker must first authenticate to the Linkis instance. They then craft a JDBC connection string that includes the allowLoadLocalInfile=true parameter and points to a malicious MySQL server they control. When Linkis establishes the connection, the MySQL Connector/J client will, by default, attempt to load local files specified by the rogue server, thus exfiltrating sensitive data from the Linkis host [2].

Impact

Successful exploitation allows the attacker to read arbitrary files from the Linkis server's filesystem, potentially exposing configuration files, credentials, or other sensitive information. This could lead to further compromise of the system or data breach [2].

Mitigation

The Apache Linkis project has addressed this vulnerability in version 1.3.1 by blacklisting dangerous JDBC parameters. Users are strongly recommended to upgrade to Linkis 1.3.1 or later [1][2]. No workarounds are documented; upgrading is the only reliable fix.