Apache dolphinscheduler sensitive information disclosure

Vulnerability

Overview

CVE-2023-48796 is an information disclosure vulnerability in Apache DolphinScheduler, a modern data orchestration platform [2]. The flaw allows an unauthorized actor to access sensitive information, including database credentials, due to improper exposure of management endpoints [1][4]. This affects versions 3.0.0 before 3.0.2, and also versions 3.1.0 before 3.2.0 as clarified in a later advisory [3][4].

Exploitation

Context

The vulnerable component is likely the management endpoints exposed by the Spring Actuator framework used in DolphinScheduler. Without proper restriction, these endpoints may leak sensitive configuration details. An attacker does not require authentication to access this information if the endpoints are exposed on the network [1][4]. The attack surface includes any network-accessible instance of the affected versions.

Impact

Successful exploitation allows an attacker to obtain sensitive data such as database credentials. This can lead to further compromise of the database backend, including data exfiltration, modification, or denial of service [1][3]. The severity is rated as important [3][4].

Mitigation

The fixed version is Apache DolphinScheduler 3.0.2 for the 3.0.x line, and users of 3.1.x should upgrade to 3.2.0 [3][4]. Administrators who cannot immediately upgrade can apply a workaround by restricting management endpoint exposure. Setting the environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus or adding the corresponding configuration in application.yaml will limit exposed endpoints to safe ones [1][4].