System account impersonation in DataHub
CVE-2023-25559

8.2HIGH

Key Information:

Vendor

Datahub-project

Status
Datahub
Vendor
CVE Published:
11 February 2023

What is CVE-2023-25559?

The DataHub metadata platform may be subject to an authorization bypass issue due to improper handling of the X-DataHub-Actor HTTP header when authentication is not enforced. By default, the metadata service operates without authentication, allowing attackers to exploit the case insensitivity of the header name. An attacker can craft a malicious request that smuggles a manipulated X-DataHub-Actor header, potentially impersonating a system user and executing unauthorized actions. This vulnerability highlights the importance of implementing secure authentication measures in software configurations.

Affected Version(s)

datahub < 0.8.45

References

https://github.com/datahub-project/datahub/security/advis...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.