JSON Injection in DataHub

CVE-2023-25560

What is CVE-2023-25560?

The AuthServiceClient component of DataHub, an open-source metadata platform, is susceptible to an authentication bypass vulnerability. This arises from the mishandling of user-controlled data in JSON strings used during account creation, credential verification, and access token management. Attackers can manipulate these strings to introduce unauthorized values, potentially allowing them to create system accounts and gain full control over the platform. Users are strongly advised to upgrade to secure their systems, as no known workarounds exist for this issue. The vulnerability was discovered by the GitHub Security lab.

References