CVE-2023-25559 System account impersonation in DataHub
Attackers can impersonate the system user by exploiting case-insensitive header handling in the default configuration, leading to unauthorized privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-25559?
CVE-2023-25559 is a high-severity authentication bypass vulnerability in datahub-project datahub, published on 10 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service (GMS) will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieves the header, its name is retrieved in a case-insensitive way. This case differential can be abused by an attacker to smuggle an X-DataHub-Actor header with different casing (eg: X-DATAHUB-ACTOR). This issue may lead to an authorization bypass by allowing any user to impersonate the system user account and perform any actions on its behalf. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-079.
Which versions are affected by CVE-2023-25559?
It affects 1 product.
Products include Datahub Datahub.
How do I fix CVE-2023-25559?
No fix has been published for CVE-2023-25559 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-25559 being exploited?
There is no known exploitation of CVE-2023-25559 in the wild and no public exploit code.
Other vulnerabilities in datahub-project datahub
- CVE-2022-39366 DataHub missing JWT signature check
- CVE-2023-25560 JSON Injection in DataHub
- CVE-2026-25644 DataHub's LDAP Ingestion Source vulnerable to MITM attack through TLS downgrade
- CVE-2023-25557 Server-Side Request Forgery in DataHub
- CVE-2023-25562 Failure to Invalidate Session on Logout in DataHub
Sources
Also known as GHSA-qgp2-qr66-j8r8.