Apache StreamPipes: Leverage of User ID for Privilege Escalation

In Apache StreamPipes through version 0.97.0, a flaw exists in the user ID creation mechanism that allows a legitimate non-administrator user to swap their username with that of an existing administrator [1][4]. This vulnerability stems from improper handling of user identifiers during account creation, enabling an attacker to manipulate the association between usernames and user IDs.

An attacker with a valid non-admin account can exploit this flaw by crafting requests that alter the user ID mapping. This manipulation directly affects the generation of JWT tokens, which are used for authentication and authorization. No special network position is required beyond standard application access; the prerequisite is merely having a legitimate non-administrator account.

Successful exploitation grants the attacker full administrative control over the StreamPipes application. This allows the attacker to tamper with data, access restricted resources, perform unauthorized actions, and potentially compromise the entire system's integrity and confidentiality.

The issue has been fixed in Apache StreamPipes version 0.98.0 [2]. Users are strongly recommended to upgrade to this version to mitigate the vulnerability. No workarounds have been published; upgrading is the only known remediation.