VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Aug 20, 2024· Updated Aug 20, 2024

Potential unauthorized access issue in apollo-portal

CVE-2024-43397

Description

Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
com.ctrip.framework.apollo:apolloMaven
< 2.3.02.3.0

Affected products

1

Patches

1
f55b419145bf

add namespaces check in synchronization configuration feature

https://github.com/apolloconfig/apolloJason SongAug 3, 2024via ghsa
commit
2 files changed · +12 −1
  • apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/controller/ItemController.java+1 −1 modified
    @@ -195,7 +195,7 @@ public List<ItemDiffs> diff(@RequestBody NamespaceSyncModel model) {
   @PutMapping(value = "/apps/{appId}/namespaces/{namespaceName}/items", consumes = {"application/json"})
   public ResponseEntity<Void> update(@PathVariable String appId, @PathVariable String namespaceName,
                                      @RequestBody NamespaceSyncModel model) {
-    checkModel(!model.isInvalid());
+    checkModel(!model.isInvalid() && model.syncToNamespacesValid(appId, namespaceName));
     boolean hasPermission = permissionValidator.hasModifyNamespacePermission(appId, namespaceName);
     Env envNoPermission = null;
     // if uses has ModifyNamespace permission then he has permission
  • apollo-portal/src/main/java/com/ctrip/framework/apollo/portal/entity/model/NamespaceSyncModel.java+11 −0 modified
    @@ -41,6 +41,17 @@ public boolean isInvalid() {
     return false;
   }
 
+  public boolean syncToNamespacesValid(String appId, String namespaceName) {
+    for (NamespaceIdentifier namespaceIdentifier : syncToNamespaces) {
+      if (appId.equals(namespaceIdentifier.getAppId()) && namespaceName.equals(
+          namespaceIdentifier.getNamespaceName())) {
+        continue;
+      }
+      return false;
+    }
+    return true;
+  }
+
   public List<NamespaceIdentifier> getSyncToNamespaces() {
     return syncToNamespaces;
   }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.