Remote Code Execution Vulnerability in Airbyte Connection Builder Docker Image
CVE-2024-38363
Currently unrated
What is CVE-2024-38363?
The Airbyte Connection Builder Docker Image is vulnerable to a severe Remote Code Execution (RCE) attack due to a Server-Side Template Injection (SSTI) flaw. This vulnerability permits an authenticated remote attacker to execute arbitrary code on the server, utilizing the privileges of the web server user. If a user tests a new connector on a compromised instance, sensitive information, including credentials, may be exposed. It's important to note that the connection builder's functionality does not extend to data processes, which means that the vulnerability can be leveraged solely during the connector testing phase. This issue has been addressed in version 0.62.2.