OpenObserveに認証回避の脆弱性、1.1.0で修正
Summary
OpenObserveの1.1.0より前の版で、SSOや移行で作られたユーザーのメールアドレスを知る第三者が、空のパスワードでそのユーザーになりすませる脆弱性が公表されました。該当版を使う組織は1.1.0に更新し、アクセスの記録も確認してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
OpenObserveの1.1.0より前の版で、SSOや移行で作られたユーザーのメールアドレスを知る第三者が、空のパスワードでそのユーザーになりすませる脆弱性が公表されました。該当版を使う組織は1.1.0に更新し、アクセスの記録も確認してください。
Original description The description as published by the source.
OpenObserve is a cloud-native observability platform. Prior to 1.1.0, the shared authentication validator in src/api/common/src/auth/validator.rs accepts an empty or whitespace-only HTTP Basic password for an account whose password_ext value is missing or empty. SSO-provisioned and migration-created users can have this state, allowing an unauthenticated attacker who knows an affected user's email address and organization to authenticate on protected non-ingestion API routes with the victim's role and permissions. A compromised privileged account can expose or modify telemetry, alerts, streams, users, and security configuration. An account with search permission can submit a DataFusion COPY ... TO statement through the search API to create or overwrite attacker-controlled files at service-process-writable locations, creating a conditional escalation to pre-authentication remote code execution. This issue is fixed in version 1.1.0.
Source: CVE.org (CVE Program・cvelistV5) NVD