acryldata datahub-helm up to 0.2.181 default key

Summaryinfo

A vulnerability described as critical has been identified in acryldata datahub-helm up to 0.2.181. The impacted element is an unknown function. Such manipulation leads to default key. This vulnerability is listed as CVE-2024-29037. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in acryldata datahub-helm up to 0.2.181. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a default key vulnerability. Using CWE to declare the problem leads to CWE-1394. The product uses a default cryptographic key for potentially critical functionality. Impacted is confidentiality, integrity, and availability. CVE summarizes:

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of time, personal access tokens were possibly created with a default secret key. Since the secret key is a static, publicly available value, someone could inspect the algorithm used to generate personal access tokens and generate their own for an instance. Deploying with Metadata Service Authentication enabled would have been difficult during window of releases. If someone circumvented the helm settings and manually set Metadata Service Authentication to be enabled using environment variables directly, this would skip over the autogeneration logic for the Kubernetes Secrets and DataHub GMS would default to the signing key specified statically in the application.yml. Most deployments probably did not attempt to circumvent the helm settings to enable Metadata Service Authentication during this time, so impact is most likely limited. Any deployments with Metadata Service Authentication enabled should ensure that their secret values are properly randomized. Version 0.2.182 contains a patch for this issue. As a workaround, one may reset the token signing key to be a random value, which will invalidate active personal access tokens.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2024-29037 since 03/14/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 0.2.182 eliminates this vulnerability. Applying the patch ea8a17860f053c63387b8309e1f77c0e1462a1b3 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• acryldata

Name

• datahub-helm

Version

• 0.2.181

License

• open-source

Website

• Product: https://github.com/acryldata/datahub-helm/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion