Apache InLong: Insufficient Session Expiration in InLong

Vulnerability

Description

CVE-2023-31065 is an insufficient session expiration vulnerability in Apache InLong, affecting versions 1.4.0 through 1.6.0 [2]. The root cause is that the application does not properly invalidate sessions when a user is deleted or their password is changed, allowing an old session to remain valid [2].

Attack

Vector

An attacker who possesses an old session token (e.g., from a previously authenticated session) can reuse that token to access the system even after the associated user account has been removed or the password has been updated [2]. No additional authentication is required if the attacker already has a valid session token. The attack can be carried out remotely over the network.

Impact

Successful exploitation allows an attacker to maintain unauthorized access to the Apache InLong instance, potentially gaining the same privileges as the deleted or modified user. This could lead to data exposure, manipulation, or disruption of data integration pipelines managed by InLong.

Mitigation

The vulnerability is addressed in Apache InLong version 1.7.0 [2]. Users can also apply patches via cherry-picking commits from pull requests #7836 and #7884, which introduce session invalidation mechanisms upon user deletion [1][4]. Pull request #7884 proposes caching user information in memory and periodically synchronizing from the database to detect invalid users and remove their sessions [4].