CVE-2024-30896: Critical severity InfluxDB InfluxDB OSS vulnerability
InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API. The supplier has stated that InfluxDB 2.8.0 has addressed this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
InfluxDBto a version that resolves this vulnerability.Fixed in 2.8.0 - Configuration
Add users to non-default organizations so they do not have read access to the authorization resource of the default organization, since InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization.
InfluxDB 2.x organizations default organization usage for authorization = Use non-default organizations for administrative/operator access
Event History
Frequently Asked Questions
What is the severity of CVE-2024-30896?
The severity of CVE-2024-30896 is considered to be high due to the potential for unauthorized access to the operator token.
How do I fix CVE-2024-30896?
To fix CVE-2024-30896, upgrade InfluxDB OSS to version 2.7.12 or later, where the operator token is stored securely.
Who is affected by CVE-2024-30896?
CVE-2024-30896 affects InfluxDB OSS versions up to 2.7.11, specifically users with read access to the default organization's authorization resource.
What kind of data can be accessed due to CVE-2024-30896?
Due to CVE-2024-30896, an authorized user can access sensitive information, including the administrative operator token.
Is there a workaround for CVE-2024-30896 before applying the patch?
A temporary workaround for CVE-2024-30896 is to limit read access to the authorization resource of the default organization until the upgrade is applied.