Apache InLong: Attackers can change the immutable name and type of cluster

CVE-2023-31103 is an Exposure of Resource to Wrong Sphere vulnerability in Apache InLong, affecting versions 1.4.0 through 1.6.0 [1]. The root cause is that the system does not properly enforce immutability for cluster name and type fields, allowing them to be changed by unauthorized actors [1].

Attackers with network access to the InLong manager service can exploit this flaw by sending crafted requests to modify these immutable properties [1]. No special privileges are required beyond the ability to interact with the vulnerable API endpoints.

Successful exploitation enables an attacker to alter the cluster's immutable name and type, potentially causing data misrouting, resource confusion, or administrative disruption [1]. The impact is primarily on the integrity and reliability of data processing pipelines.

Apache has addressed the issue in version 1.7.0, or users can apply the fix via pull request #7891, which adds validation to prevent modification of these critical fields [3].