Apache InLong: Privilege escalation vulnerability for InLong

Overview

CVE-2023-31062 is an improper privilege management vulnerability in Apache InLong, a one-stop integration framework for massive data. Affecting versions 1.2.0 through 1.6.0, the flaw stems from insufficient authorization checks when processing certain API requests[1][2].

Exploitation

An attacker with access to a valid but unprivileged account can exploit this vulnerability by sending a legitimate login request and then using the returned session cookie to craft a subsequent HTTP request that executes privileged actions[2]. The exploit can be performed using tools like Burp Suite to manipulate the request flow. No additional authentication or network access beyond a valid low-privileged account is required[2].

Impact

Successful exploitation allows an attacker to perform operations that should require higher privileges, such as managing user permissions or accessing restricted functions. As described in the associated pull request, the fix addresses removing permissions when a user is deleted, indicating that the vulnerability could enable unauthorized privilege changes or data access[1][2].

Mitigation

The Apache InLong project has released version 1.7.0, which resolves this vulnerability. Users unable to upgrade immediately can apply the security patch from the referenced pull request (#7836) to correct the permission handling logic[1][2]. No workaround other than applying the patch or upgrading is currently documented.