The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all REST API communication between the Uniffle CLI/client and the Uniffle Coordinator service to potential Man-in-the-Middle (MITM) attacks. This issue affects all versions from before 0.10.0. Users are recommended to upgrade to version 0.10.0, which fixes the issue.
The HTTP client in Apache Uniffle is configured to accept any SSL certificate without verifying its validity and without checking whether the hostname in the certificate matches the target server (CWE-297: Improper Validation of Certificate with Host Mismatch). This means that an attacker located on the network path between the Uniffle CLI/client and the Uniffle Coordinator service can substitute their own certificate and intercept or modify REST API traffic. Since SSL verification is disabled by default, the attack is possible without any additional configuration on the victim's side.
An attacker can intercept and modify all REST API communication between the Uniffle client and the Coordinator service, leading to violation of confidentiality and integrity of transmitted data.
Apache Uniffle should be updated to version 0.10.0 or later, which resolves the issue through proper SSL certificate and hostname verification.
All Apache Uniffle versions before 0.10.0
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NApache Uniffle
APPApache< 0.10.0
Related vulnerabilities
Apache Tomcat: Path Equivalence prowadzący do RCE i ujawnienia danych
Apache OFBiz — nieautoryzowane wykonanie kodu przez błędną autoryzację
Apache HTTP Server mod_rewrite — ujawnienie kodu i RCE poprzez błędne escapowanie
Path Traversal w Apache OFBiz umożliwiający zdalne wykonanie kodu
RCE w Apache HugeGraph-Server — zdalne wykonanie poleceń bez uwierzytelnienia