Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints

Vulnerability

Overview

CVE-2023-39196 is an improper authentication vulnerability in Apache Ozone affecting versions 1.2.0 through 1.3.0. The root cause is a missing mutual TLS authentication check in one of the internal endpoints of the Storage Container Manager service [1][3]. This allows an unauthenticated attacker to download metadata that is internal to the Storage Container Manager.

Exploitation and

Impact

An attacker can exploit this vulnerability by sending requests to the affected endpoint without any authentication [3]. The attacker cannot modify any data within the Storage Container Manager using this vulnerability. The accessible metadata does not contain sensitive information that could be used for further exploitation, nor does it allow access to actual user data within Ozone [1]. Thus, the impact is limited to unauthorized information disclosure of non-sensitive metadata.

Mitigation

The Apache Ozone project has released version 1.4.0, which fixes the vulnerability by properly enforcing authentication for the affected endpoint [1][3]. Users running versions 1.2.0 through 1.3.0 are recommended to upgrade to 1.4.0 or later to remediate the issue [1][3]. No workarounds or patches for earlier versions have been mentioned.