Apache Linkis Basic management services: Engine material management Arbitrary file deletion vulnerability

Vulnerability

Description

CVE-2024-27182 is an arbitrary file deletion vulnerability in the Basic management services component of Apache Linkis, specifically affecting the engine material management functionality [1]. Versions up to and including 1.5.0 are vulnerable. The root cause lies in insufficient access control checks within the Basic management service, allowing a user with administrative privileges to delete any file that the Linkis system user can access [2].

Exploitation

To exploit this vulnerability, an attacker must have a valid administrator account on the Apache Linkis instance [3]. No other network position or authentication bypass is required; the attacker simply leverages their administrative access to the Basic management services. The attack can be performed remotely, deleting files outside the intended scope of the management interface.

Impact

A successful exploit allows an attacker to delete arbitrary files on the server running Linkis, limited only by the file system permissions of the Linkis system user [2]. This could lead to deletion of configuration files, application data, or critical system files, potentially causing denial of service, data loss, or further compromise of the host system.

Mitigation

The vulnerability is fixed in Apache Linkis version 1.6.0 [3]. Users are strongly recommended to upgrade to this version or later. No workarounds have been provided for older versions; administrators should restrict access to admin accounts as a temporary mitigation.