Apache InLong: Insecure direct object references for inlong sources

Vulnerability

Description

CVE-2023-31066 is an access control vulnerability in Apache InLong, a data integration framework. In versions 1.4.0 through 1.6.0, the application fails to properly verify that a user has permission to modify resources belonging to another user. Specifically, the stream source management endpoints lack authorization checks, allowing any authenticated user to delete, edit, stop, or start sources owned by other users [1].

Attack

Vector and Prerequisites

The vulnerability can be exploited by any authenticated user of the InLong platform. No special privileges are required beyond access to the web interface or API. An attacker can directly interact with the affected endpoints to target sources created by other users. The missing permission checks occur at the service layer, where the user identity is not validated against the resource owner [3].

Impact

A successful exploit allows an attacker to disrupt data pipelines by stopping or starting other users' sources, or altering their configuration. This can lead to data loss, corruption, or service unavailability. In a multi-tenant environment, the ability to modify another user's sources undermines the integrity and reliability of the data integration system [1].

Mitigation

Apache InLong version 1.7.0 includes a fix for this vulnerability. Users unable to upgrade can apply the patch from pull request #7775, which adds permission verification for stream source operations [3]. The fix ensures that modifications to a source are only allowed if the requesting user is the owner or has appropriate group-level permissions.