CVE-2023-47629 in datahub
Summary
by MITRE • 11/14/2023
DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the default datahub user has been removed, then the user can sign up for an account that leverages the default policies giving admin privileges to the datahub user. All DataHub instances prior to the patch that have removed the datahub user, but not the default policies applying to that user are affected. Users are advised to update to version 0.12.1 which addresses the issue. There are no known workarounds for this vulnerability.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 12/08/2023
The vulnerability identified as CVE-2023-47629 affects DataHub, an open-source metadata platform designed to manage and govern enterprise data assets. This security flaw resides in the platform's user registration mechanism, specifically within the invitation-based sign-up process that lacks proper access control enforcement. The issue manifests when users receive email invitation links that should restrict account creation to standard user roles but instead allow malicious actors to potentially escalate their privileges to administrative status. The vulnerability represents a critical authorization bypass that undermines the platform's security model and could enable unauthorized individuals to gain elevated system access.
The technical flaw stems from improper input validation and privilege enforcement during the user registration workflow. When a user accesses an invitation link, the system should verify that the registration process adheres to predefined role restrictions and access controls. However, in affected versions, the platform fails to properly validate whether the user attempting registration should be granted administrative privileges. This weakness allows attackers to manipulate the registration process and create accounts with elevated permissions, particularly when the default datahub user account has been removed from the system but the associated default policies remain intact. The vulnerability operates through a combination of insufficient access control checks and improper privilege validation mechanisms that should have prevented administrative account creation during the invitation-based signup process.
The operational impact of this vulnerability is severe and potentially catastrophic for organizations relying on DataHub for metadata management and data governance. An attacker exploiting this vulnerability could gain administrative access to the entire metadata platform, enabling them to modify or delete critical metadata definitions, manipulate access controls, view sensitive data catalogs, and potentially exfiltrate or corrupt enterprise data assets. The risk is particularly elevated in environments where the default datahub user has been removed but default policies persist, as this configuration creates a scenario where any user registering through an invitation link could inadvertently assume administrative privileges. This vulnerability directly violates the principle of least privilege and could compromise the integrity and confidentiality of enterprise data governance systems.
Organizations using DataHub must immediately update to version 0.12.1 to address this vulnerability, as no effective workarounds exist for mitigating the risk. The patch implemented in version 0.12.1 resolves the access control bypass by strengthening the validation checks during user registration processes and ensuring that invitation-based signups properly enforce role restrictions. Security teams should conduct immediate assessments of their DataHub deployments to identify systems running affected versions and implement the necessary updates across all instances. This vulnerability aligns with CWE-285, which addresses improper authorization in software systems, and maps to ATT&CK technique T1078.004 for valid accounts, as it enables unauthorized privilege escalation through legitimate registration mechanisms. The vulnerability demonstrates the critical importance of proper access control implementation in metadata management platforms where administrative privileges can have far-reaching impacts on data governance and security posture.