Apache Linkis gateway module token authentication bypass

Vulnerability

Description

In Apache Linkis versions up to and including 1.3.1, the default token generated by the Gateway deployment uses a predictable generation rule without sufficient randomness [1][2]. This makes it easy for attackers to guess or obtain the default token, bypassing the intended token authentication mechanism [4].

Exploitation

An attacker can exploit this by sending HTTP requests to the Linkis Gateway with the guessed default token in the Token-Code header or cookie [3]. No prior authentication or special network position is required, as the Gateway is typically exposed to external networks. The token is static by default, allowing repeated use until changed [4].

Impact

Successful exploitation grants the attacker unauthorized access to the Linkis Gateway, enabling them to submit jobs to underlying data engines (e.g., Spark, Hive) and potentially access sensitive data or execute arbitrary commands within the context of the token's configured user [1][2].

Mitigation

The issue is addressed in Apache Linkis version 1.3.2, which enforces random token generation [2][4]. Users are strongly advised to upgrade to 1.3.2 and also manually modify the default token value. Refer to the token authorization documentation for configuration guidance [3].