CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets

What is CVE-2024-45106?

CVE-2024-45106 is a high-severity missing authorization vulnerability in Apache Ozone, published on 3 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: * ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is false. * The user configured in ozone.s3g.kerberos.principal is also configured in ozone.s3.administrators or ozone.administrators.

Users are recommended to upgrade to Apache Ozone version 1.4.1 which disables the affected endpoint.

Weakness: CWE-863, CWE-287

Which versions are affected by CVE-2024-45106?

2 open source packages ship an affected version, including org.apache.ozone:ozone. It affects 1 product.

Products include Apache Ozone.

How do I fix CVE-2024-45106?

Upgrade org.apache.ozone:ozone to 1.4.1 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-45106 being exploited?

There is no known exploitation of CVE-2024-45106 in the wild and no public exploit code.

Other vulnerabilities in Apache Ozone

• CVE-2021-36372 Original block tokens are persisted and can be retrieved Critical 9.8
• CVE-2021-39231 Missing authentication/authorization on internal RPC endpoints Critical 9.1
• CVE-2021-39233 Container-related datanode operations can be called without authorization Critical 9.1
• CVE-2021-39232 Missing admin check for SCM related admin commands High 8.8
• CVE-2021-39236 Owners of the S3 tokens are not validated High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rcq8-9q3j-98mw.