DataHub Code Issue Vulnerability

DataHub is datahub-project open source metadata platform for a modern data stack. A code issue vulnerability exists in DataHub versions prior to 0.11.1, which stems from the DataHub front-end not setting a cookie expiration time, resulting in the cookie being permanently valid after an attacker...

CVE-2023-25558

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the idtoken is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

CVE-2023-25560

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

CVE-2023-25561

DataHub is an open-source metadata platform. In the event a system is using Java Authentication and Authorization Service JAAS authentication and that system is given a configuration which contains an error, the authentication for the system will fail open and allow an attacker to login using any...

CVE-2023-25562

DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the AuthUtils.hasValidSessionCookie method could be bypassed by using a cookie from a logged out...

CVE-2023-25557

DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store GMS. It has been discovered that the...

CVE-2023-25559

DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service GMS will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieve...

Authentication flaw

DataHub is an open-source metadata platform. In versions of DataHub prior to 0.8.45 Session cookies are only cleared on new sign-in events and not on logout events. Any authentication checks using the AuthUtils.hasValidSessionCookie method could be bypassed by using a cookie from a logged out...

Design/Logic Flaw

DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store GMS. It has been discovered that the...

Design/Logic Flaw

DataHub is an open-source metadata platform. When the DataHub frontend is configured to authenticate via SSO, it will leverage the pac4j library. The processing of the idtoken is done in an unsafe manner which is not properly accounted for by the DataHub frontend. Specifically, if any of the...

Authorization

DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service GMS will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieve...

Authentication flaw

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

DataHub 安全漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub suffers from a security vulnerability that stems from the presence of an authentication bypass, which is exploited by an attacker to create a system account, leading to a compromise of the entire system...

DataHub 代码问题漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub is vulnerable to a code issue. An attacker exploits this vulnerability to remotely execute code...

DataHub 授权问题漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub is vulnerable to an authorization issue. An attacker exploiting this vulnerability could impersonate a system user account and perform any action on its behalf...

DataHub 代码问题漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub suffers from a code issue vulnerability that stems from an agent not adequately constructing URLs when forwarding data to a metadata store GMS.An attacker exploits this vulnerability to redirect requests fro...

DataHub 安全漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub has a security vulnerability. An attacker exploiting this vulnerability could gain access to the system...

DataHub 代码问题漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub suffers from a code issue vulnerability that stems from the fact that session cookies are only cleared on a new login event, not on a logout event, and any logged out session cookies could be considered vali...

CVE-2023-25557

Summary: CVE-2023-25557 affects DataHub’s frontend proxy, which forwards REST/GraphQL requests to the DataHub Metadata Store (GMS). The proxy may mishandle URL construction when relaying requests, enabling a Server-Side Request Forgery (SSRF) where an attacker could redirect a frontend-originated...

CVE-2023-25557 Server-Side Request Forgery in DataHub

DataHub is an open-source metadata platform. The DataHub frontend acts as a proxy able to forward any REST or GraphQL requests to the backend. The goal of this proxy is to perform authentication if needed and forward HTTP requests to the DataHub Metadata Store GMS. It has been discovered that the...