Apache DolphinScheduler: Information Leakage Vulnerability

Vulnerability

Overview

CVE-2023-49068 is an information exposure vulnerability in Apache DolphinScheduler, an open-source distributed workflow orchestration platform [2]. The flaw affects versions prior to 3.2.1 and stems from the application logging sensitive session identifiers (session IDs) into system logs during user authentication [4]. While the log is typically only accessible to operators, the explicit recording of session IDs introduces a risk of session hijacking if those logs are exposed or leaked [1][4].

Exploitation

Vector

The vulnerability is triggered automatically during the authentication process. When a user logs in, the session ID is recorded in a log statement such as log.info("Session is created and sessionId is :{ }.", sessionId). An attacker who gains read access to the logs—through misconfigured log storage, compromised logging infrastructure, or insider threats—can extract active session IDs. No special privileges or additional authentication on the DolphinScheduler instance are required beyond access to the logs.

Impact

An unauthorized actor who obtains a valid session ID can impersonate the legitimate user, gaining the same level of access to the DolphinScheduler instance. This includes viewing, modifying, or running workflows, accessing data source configurations, and potentially exfiltrating sensitive orchestration metadata or credentials. The confidentiality of the system is compromised, and the attack can lead to privilege escalation or data breaches.

Mitigation

Apache has addressed the issue by modifying the authentication log to remove the session ID and instead log only the username (e.g., log.info("Session is created, userName:{ }.", user.getUserName())) in commit 7308888 [4]. The fix is included in version 3.2.1 [1]. Users who cannot immediately upgrade should restrict log access to trusted operators and consider rotating any exposed session tokens [1].