CVE-2023-41916: Apache Linkis DataSource: DatasourceManager module has a JDBC parameter judgment logic vulnerability that allows for arbitrary file reading
In Apache Linkis = 1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out.
Versions of Apache Linkis = 1.4.0 will be affected.
We recommend users upgrade the version of Linkis to version 1.6.0.
Other sources
In Apache Linkis =1.4.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will trigger arbitrary file reading. Therefore, the parameters in the Mysql JDBC URL should be blacklisted. This attack requires the attacker to obtain an authorized account from Linkis before it can be carried out. Versions of Apache Linkis = 1.4.0 will be affected. We recommend users upgrade the version of Linkis to version 1.5.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41916?
CVE-2023-41916 is considered to have a high severity due to the potential for arbitrary file reading through malicious JDBC parameters.
How do I fix CVE-2023-41916?
To fix CVE-2023-41916, update Apache Linkis to version 1.6.0 or later, which includes a blacklist for malicious parameters.
What versions of Apache Linkis are affected by CVE-2023-41916?
Apache Linkis versions from 1.4.0 up to 1.6.0 are affected by CVE-2023-41916.
What type of vulnerability is CVE-2023-41916?
CVE-2023-41916 is a code injection vulnerability that allows attackers to read arbitrary files.
Is my DataSource Manager Module vulnerable to CVE-2023-41916?
If you are using Apache Linkis versions 1.4.0 to 1.6.0, your DataSource Manager Module is vulnerable to CVE-2023-41916.