GO-2022-1019 lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs

lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs...

GO-2022-0375 Improper Access Control in github.com/treeverse/lakefs

Improper Access Control in github.com/treeverse/lakefs...

GO-2023-2398 lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs

lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs...

GO-2023-2012 lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs

lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs...

Improper Access Control

LakeFS is vulnerable to Improper Access Control. The vulnerability is due to improper permission validation, enabling users with ci:ReadAction to access unauthorized data by copying objects to accessible paths...

User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository

Impact A bug in permissions validation allows a user with the ci:ReadAction permission to skip read checks when copying an object. If they additionally have read and write permission to path in the repository, they can copy an otherwise unreadable object and read it. In order to be affected and...

GHSA-FVV5-H29G-F6W5 User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository

Impact A bug in permissions validation allows a user with the ci:ReadAction permission to skip read checks when copying an object. If they additionally have read and write permission to path in the repository, they can copy an otherwise unreadable object and read it. In order to be affected and...

GHSA-26HR-Q2WP-RVC5 User with permission to write actions can impersonate another user when auth token is configured in environment variable

Impact When lakeFS is configured with ALL of the following: - Configuration option auth.encrypt.secretkey passed through environment variable - Actions enabled via configuration option actions.enabled default enabled then a user who can configure an action can impersonate any other user. Patches...

Cross-site Scripting (XSS)

github.com/treeverse/lakefs is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the controller.go and getobject.go, which allows an attacker to inject and execute malicious JavaScript when opening a direct link to an HTML file via lakeFS...

lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files

Impact The browser renders the resulting HTML when opening a direct link to an HTML file via lakeFS. Any JavaScript within that page is executed within the context of the domain lakeFS is running in. An attacker can inject a malicious script inline, download resources from another domain, or make...

lakeFS vulnerable to authenticated users deleting files they are not authorized to delete

Impact Authenticated users can send a request to delete-objects through the s3 gateway and delete files they are not authorized to delete. Patches lakeFS v0.82.0 and later Workarounds Drop specific request to the lakeFS listen port. Any request with "Authorization" header and value that starts wi...

Improper Access Control in github.com/treeverse/lakefs

Impact 1. medium A user with write permissions to a portion of a repository may use the S3 gateway to copy any object in the repository if they know its name. 1. medium A user with permission to write any one of tags, branches, or commits on a repository may write all of them. 1. low A user with...