CVE-2023-48396 Apache SeaTunnel Web: Authentication bypass
Attackers can forge JWT tokens using a hardcoded key to bypass authentication and log in as any user in Apache SeaTunnel Web.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-48396?
CVE-2023-48396 is a critical vulnerability in Apache SeaTunnel Web, published on 30 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user.
Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0.
Users are recommended to upgrade to version 1.0.1, which fixes the issue.
Weakness: CWE-290
Which versions are affected by CVE-2023-48396?
2 open source packages ship an affected version, including org.apache.seatunnel:seatunnel-web. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.seatunnel:seatunnel-web Maven | All versions | 1.0.1 |
org.apache.seatunnel:seatunnel-web Maven | All versions | 1.0.1 |
Products include Apache Seatunnel.
How do I fix CVE-2023-48396?
Upgrade org.apache.seatunnel:seatunnel-web to 1.0.1 or later.
Is CVE-2023-48396 being exploited?
There is no known exploitation of CVE-2023-48396 in the wild and no public exploit code.
Other vulnerabilities in Apache SeaTunnel Web
Sources
Also known as GHSA-cp2c-x2pc-fph7.