Apache Linkis DataSource up to 1.5.0 JDBC Datasource of injection

Summaryinfo

A vulnerability was found in Apache Linkis DataSource up to 1.5.0. It has been declared as critical. Impacted is an unknown function of the component JDBC Datasource Module. The manipulation of the argument of results in injection. This vulnerability is reported as CVE-2023-49566. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Apache Linkis DataSource up to 1.5.0. Affected is some unknown processing of the component JDBC Datasource Module. The manipulation of the argument of with an unknown input leads to a injection vulnerability. CWE is classifying the issue as CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In Apache Linkis <=1.5.0, due to the lack of effective filtering of parameters, an attacker configuring malicious db2 parameters in the DataSource Manager Module will result in jndi injection. Therefore, the parameters in the DB2 URL should be blacklisted.  This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis <=1.5.0 will be affected. We recommend users upgrade the version of Linkis to version 1.6.0.

The advisory is shared for download at seclists.org. This vulnerability is traded as CVE-2023-49566 since 11/27/2023. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 07/15/2024). The MITRE ATT&CK project declares the attack technique as T1055.

Upgrading to version 1.6.0 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Linkis DataSource

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5.0

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion