CKAN remote code execution and private information access via crafted resource ids

CVE-2023-32321

Summary

CKAN, an open-source data management system, is subject to multiple vulnerabilities that could lead to significant security risks, including remote code execution. An attacker can exploit arbitrary file write capabilities through 'resource_create' and 'package_update' actions. Other vulnerable actions include 'package_create', 'package_revise', and 'package_patch', allowing access to sensitive system resources. Additionally, unsafe pickle loading in Beaker's session store configured for file storage creates pathways for remote code execution. Users can also face resource overwrite risks and information disclosure if they possess permissions to create resources and manipulate specific IDs. These vulnerabilities have been addressed in CKAN versions 2.9.9 and 2.10.1, emphasizing the need for users to upgrade promptly as no workarounds are available.

References