Apache InLong: Attackers can change the immutable name and type of nodes

CVE-2023-31206 is an exposure-of-resource-to-wrong-sphere vulnerability in Apache InLong, a one-stop, full-scenario data integration framework. The issue affects versions 1.4.0 through 1.6.0 and stems from missing checks that allow users to modify the data_node_name and cluster_name fields, which are intended to be immutable and serve as foreign keys for resource isolation.

An attacker with access to the InLong manager interface could change these node identifiers, effectively altering the path by which data resources are accessed. This does not require authenticated user privileges beyond normal access, as the vulnerability lies in the lack of server-side validation on these fields, as described in the advisory [1]. The GitHub pull request #7891 [3] fixes the issue by adding validation and introducing display-name fields to decouple identity from display.

The impact is that an attacker can redirect data flows or misattribute resource ownership, potentially reading or writing data to unintended nodes. This breaks the trust model of InLong's resource management, which relies on immutable names for integrity. The CVSS vector is not yet provided by NVD [1], but the vulnerability is classified as critical by the maintainer due to the ease of exploitation and potential for data leakage.

Mitigation is straightforward: users should upgrade to Apache InLong version 1.7.0 or apply the cherry-pick commit from the referenced pull request [1][3]. No official workaround has been provided, and the project recommends upgrading as the only remediation for affected versions.