Apache StreamPark: Information leakage vulnerability

Vulnerability

Details

CVE-2024-29120 is an information leakage vulnerability in Apache StreamPark versions prior to 2.1.4. After a successful login, the backend service returns an "Authorization" token intended for front-end authentication. However, this token is not properly scoped, allowing a user to request sensitive information about other users, including the administrator's username, password, and salt value [1][3].

Exploitation

An attacker must have a valid user account on the StreamPark instance. Upon logging in, they receive the Authorization token. Using this token, they can make API requests to retrieve other users' details without any additional authentication or authorization checks. The vulnerability is triggered by simply using the token to query user information endpoints [1][3].

Impact

Successful exploitation leads to the disclosure of administrator credentials (username, password, and salt). With these, an attacker can fully compromise the administrator account, gaining unrestricted access to the StreamPark platform and potentially the underlying streaming applications and data [1][3].

Mitigation

The vulnerability is fixed in Apache StreamPark version 2.1.4. All users are advised to upgrade immediately. No workarounds are documented. The issue was reported by L0ne1y [3].