CVE-2023-25559: System account impersonation in DataHub
First published: Fri Feb 10 2023(Updated: )
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieves the header, its name is retrieved in a case-insensitive way. This case differential can be abused by an attacker to smuggle an X-DataHub-Actor header with different casing (eg: X-DATAHUB-ACTOR). This issue may lead to an authorization bypass by allowing any user to impersonate the system user account and perform any actions on its behalf. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-079.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Datahub | <0.8.45 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2023-25559?
CVE-2023-25559 is a vulnerability found in DataHub, an open-source metadata platform.
What is the severity of CVE-2023-25559?
CVE-2023-25559 has a severity rating of 8.1, which is considered high.
How does CVE-2023-25559 affect DataHub?
CVE-2023-25559 affects DataHub versions up to and excluding 0.8.45.
What is the default configuration of DataHub regarding authentication for the metadata service?
The default configuration of DataHub does not use authentication for the metadata service.
How does the Metadata service (GMS) in DataHub infer the user when not using authentication?
When not using authentication, the Metadata service (GMS) in DataHub uses the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of.
Where can I find more information about CVE-2023-25559?
You can find more information about CVE-2023-25559 in the DataHub security advisory: https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/references
- agent/severity
- agent/title
- agent/author
- agent/first-publish-date
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/datahub project
- canonical/datahub