CVE-2021-39231 Missing authentication/authorization on internal RPC endpoints

What is CVE-2021-39231?

CVE-2021-39231 is a critical missing authorization vulnerability in Apache Ozone, published on 19 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible for an attacker to download raw data from Datanode and Ozone manager and modify Ratis replication configuration.

Weakness: CWE-862

Which versions are affected by CVE-2021-39231?

2 open source packages ship an affected version, including org.apache.ozone:ozone-main. It affects 1 product.

Products include Apache Ozone.

How do I fix CVE-2021-39231?

Upgrade org.apache.ozone:ozone-main to 1.2.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-39231 being exploited?

There is no known exploitation of CVE-2021-39231 in the wild and no public exploit code.

Other vulnerabilities in Apache Ozone

• CVE-2021-36372 Original block tokens are persisted and can be retrieved Critical 9.8
• CVE-2021-39233 Container-related datanode operations can be called without authorization Critical 9.1
• CVE-2021-39232 Missing admin check for SCM related admin commands High 8.8
• CVE-2021-39236 Owners of the S3 tokens are not validated High 8.8
• CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3w5h-x4rh-hc28.