Apache Linkis publicsercice module unrestricted upload of file

Vulnerability

Overview

CVE-2023-27602 affects Apache Linkis versions up to and including 1.3.1. The PublicService module lacks proper restrictions on the path and file types of uploaded files, enabling an attacker to upload files to arbitrary locations within the system [1].

Exploitation

An attacker with network access to the Linkis PublicService endpoint can exploit this vulnerability by crafting a file upload request without the necessary path validation. No authentication is required to trigger the upload functionality, as the module does not enforce proper checks on the destination path or file extension [1].

Impact

Successful exploitation allows an attacker to place arbitrary files anywhere on the filesystem that the Linkis service has write permissions. This could lead to remote code execution if a malicious file (e.g., a web shell or a configuration override) is written to a location that is later executed or interpreted by the application or system [1][2]. The vulnerability is considered critical because of the potential for full system compromise.

Mitigation

Users should upgrade to Apache Linkis version 1.3.2 or later, which addresses the issue. For deployments that cannot immediately upgrade, administrators can enable file path validation by setting the properties wds.linkis.workspace.filesystem.owner.check=true and wds.linkis.workspace.filesystem.path.check=true in the linkis.properties configuration file [1].