Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check. This issue affects Apache Doris: from 1.2.0 through 2.0.4. Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.
When creating a JDBC catalog in Apache Doris, the system does not verify the integrity or contents of the supplied JAR file with the driver. An attacker with JDBC catalog creation privileges can point to any JAR file containing malicious code. This code is executed automatically when the catalog is initialized, without any verification, leading to remote code execution (RCE) on the server.
An attacker can gain full control over the server — confidentiality, integrity, and availability of the system are completely compromised (CVSS C:H/I:H/A:H). It is possible to execute arbitrary system commands in the context of the Apache Doris process.
Apache Doris should be updated to version 2.0.5 or to the 2.1.x branch, which contain a patch eliminating this vulnerability. Until the update is applied, JDBC catalog creation privileges should be restricted to trusted users only.
Apache Doris in versions from 1.2.0 to 2.0.4 inclusive.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Doris
APPApache1.2.0 – 2.0.5 (bez)
Related vulnerabilities
Apache Doris — podatność metody uwierzytelniania na timing attack
The api /api/snapshot and /api/get_log_file would allow unauthenticated access. It could allow a DoS attack or...
Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, whi...
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Files or Directories Accessibl...
Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run th...