CVE-2023-25560 JSON Injection in DataHub

High 8.2 Published 10 Feb 2023 Updated 10 Mar 2025

Attackers can inject JSON to bypass authentication and create system accounts, leading to full system compromise in DataHub.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-25560?

CVE-2023-25560 is a high-severity code injection vulnerability in datahub-project datahub, published on 10 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.

Weakness: CWE-913

Which versions are affected by CVE-2023-25560?

It affects 1 product.

Products include Datahub Datahub.

How do I fix CVE-2023-25560?

No fix has been published for CVE-2023-25560 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-25560 being exploited?

There is no known exploitation of CVE-2023-25560 in the wild and no public exploit code.

Sources

Also known as GHSA-6rpf-5cfg-h8f3.