Apache InLong: IDOR make users can delete others' subscription

CVE-2023-31453 is an incorrect permission assignment for critical resource vulnerability affecting Apache InLong versions 1.2.0 through 1.6.0. The root cause is a missing user authentication check when performing operations on subscriptions, specifically in the "inlong consume" functionality. This allows an attacker to delete subscriptions that belong to other users, even without being the owner of those subscriptions [1][2].

Exploitation

An attacker needs to have network access to an InLong instance and be able to send authenticated requests, but does not need any special privileges beyond a basic user account. The vulnerability resides in the Manager component, where the application fails to verify that the requesting user owns the subscription before allowing deletion [1]. This lack of authorization check means any authenticated user can enumerate and delete existing subscriptions.

Impact

By deleting another user's subscriptions, an attacker can disrupt data ingestion, synchronization, or subscription pipelines that rely on those subscriptions. This could lead to data loss, service unavailability, and potentially broader system instability, as InLong is used for massive data integration scenarios [3].

Mitigation

The vulnerability is fixed in Apache InLong version 1.7.0, which includes proper user authentication for the affected operations. Users unable to upgrade immediately can cherry-pick the specific pull request [1] that addresses the issue. As of the publication date, no workarounds beyond patching have been provided, and the CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.