CVE-2022-44644 Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability

What is CVE-2022-44644?

CVE-2022-44644 is a medium-severity path traversal vulnerability in Apache Linkis (incubating), published on 31 Jan 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. 

We recommend users upgrade the version of Linkis to version 1.3.1

Weakness: CWE-20

Which versions are affected by CVE-2022-44644?

2 open source packages ship an affected version, including org.apache.linkis:linkis. It affects 1 product.

Products include Apache Linkis.

How do I fix CVE-2022-44644?

Upgrade org.apache.linkis:linkis to 1.3.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-44644 being exploited?

There is no known exploitation of CVE-2022-44644 in the wild and no public exploit code.

Other vulnerabilities in Apache Linkis (incubating)

• CVE-2023-27602 Apache Linkis publicsercice module unrestricted upload of file Critical 9.8
• CVE-2023-27603 Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue Critical 9.8
• CVE-2023-29215 Apache Linkis JDBC EngineCon has a deserialization command execution Critical 9.8
• CVE-2023-29216 Apache Linkis DatasourceManager module has a deserialization command execution Critical 9.8
• CVE-2023-27987 Apache Linkis gateway module token authentication bypass Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rx76-xw35-6rh8.