CVE-2020-17517 Ozone S3 Gateway allows bucket and key access to non authenticated users
Unauthenticated users can access S3 buckets and keys in Apache Ozone clusters, exposing sensitive data to anonymous clients.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-17517?
CVE-2020-17517 is a high-severity missing authorization vulnerability in Apache Ozone, published on 27 Apr 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The S3 buckets and keys in a secure Apache Ozone Cluster must be inaccessible to anonymous access by default. The current security vulnerability allows access to keys and buckets through a curl command or an unauthenticated HTTP request. This enables unauthorized access to buckets and keys thereby exposing data to anonymous clients or users. This affected Apache Ozone prior to the 1.1.0 release.
Which versions are affected by CVE-2020-17517?
It affects 1 product.
Products include Apache Ozone.
How do I fix CVE-2020-17517?
No fix has been published for CVE-2020-17517 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-17517 being exploited?
There is no known exploitation of CVE-2020-17517 in the wild and no public exploit code.
Other vulnerabilities in Apache Ozone
- CVE-2021-36372 Original block tokens are persisted and can be retrieved
- CVE-2021-39231 Missing authentication/authorization on internal RPC endpoints
- CVE-2021-39233 Container-related datanode operations can be called without authorization
- CVE-2021-39232 Missing admin check for SCM related admin commands
- CVE-2021-39236 Owners of the S3 tokens are not validated
Sources
Also known as GHSA-h253-pq36-ggpj.