CVE-2020-15087 in Presto
Summary
by MITRE
In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure. This only affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver. This vulnerability has been fixed in version 337. Additionally, this issue can be mitigated by blocking network access to internal APIs on the coordinator and workers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2020
The vulnerability described in CVE-2020-15087 represents a critical authorization bypass flaw in Presto database query engine versions prior to 337. This security weakness specifically targets installations that have configured secure internal communication, creating a dangerous scenario where authenticated users can circumvent intended access controls through direct API manipulation. The vulnerability stems from insufficient validation of API access requests, allowing malicious actors with legitimate authentication credentials to exploit internal communication endpoints that should remain restricted. This issue directly impacts the principle of least privilege and demonstrates a failure in proper access control implementation within the Presto server architecture.
The technical flaw manifests when authenticated users leverage their valid credentials to access internal APIs that are typically protected through secure communication channels. These internal endpoints, designed to facilitate communication between coordinator and worker nodes in distributed query processing, become vulnerable to unauthorized access when proper authorization checks are bypassed. The vulnerability operates at the application layer and specifically targets the server-side components of Presto installations, where internal API endpoints are not adequately protected against direct access attempts. This authorization bypass can be achieved through simple API request manipulation or by exploiting the absence of proper access control validation at the internal API endpoints.
The operational impact of this vulnerability extends beyond simple unauthorized access, potentially enabling attackers to gain insights into internal system architecture, manipulate query execution processes, or even escalate privileges within the distributed database environment. When installations have secure internal communication configured, this vulnerability creates an attack vector that undermines the entire security posture of the Presto deployment. The implications are particularly severe in enterprise environments where Presto serves as a critical component for data analytics and query processing across distributed systems. Attackers could leverage this vulnerability to disrupt query operations, access sensitive data through internal communication channels, or potentially use the compromised internal APIs as stepping stones for further attacks within the network infrastructure.
Organizations affected by this vulnerability should immediately upgrade to Presto version 337 or later, which includes proper authorization controls and access validation for internal APIs. Additionally, network-level mitigations provide effective defense-in-depth strategies, including blocking direct network access to internal APIs on both coordinator and worker nodes. This approach aligns with the principle of network segmentation and follows security best practices for protecting internal communication channels. The vulnerability classification aligns with CWE-285, which addresses improper authorization issues in software systems, and represents a specific instance of the broader ATT&CK technique T1078 for valid accounts and T1068 for exploit for privilege escalation. Network administrators should implement firewall rules and access control lists to restrict internal API endpoints to only trusted internal communication paths, while system administrators should verify that secure internal communication configurations are properly enforced through proper access control mechanisms.
The mitigation strategies for this vulnerability encompass both software patching and network-level controls, providing organizations with flexible approaches to address the security gap. The recommended approach of blocking network access to internal APIs represents a robust defensive measure that can be implemented immediately while awaiting the software upgrade. This network-level restriction prevents direct access attempts to vulnerable internal endpoints, effectively neutralizing the attack vector even if the underlying software vulnerability persists. The security implications extend to compliance requirements for data protection and access control, as organizations must ensure that their database query engines maintain proper authorization boundaries to prevent unauthorized access to internal system components. This vulnerability underscores the importance of proper access control implementation and the need for comprehensive security testing of internal communication protocols in distributed database systems.