Minor authentication bypass flaw
Details
| Detail name | Value |
|---|---|
| Changelog Number | 23254 |
| Type | Bug |
| Status | Resolved |
| Affected Versions | Exasol 8.0.0 |
| Fix Versions | Exasol 8.29.8, Exasol 8.34.0 |
| Resolution Date | 2025-03-10 |
Description
For technical reasons, several internal ConfD jobs must currently be callable without prior authentication. This is not a problem per se, because these jobs only provide a very narrow and carefully selected set of functionality. However, due to a flaw in our code, an unauthenticated user was able to trigger additional actions related to these internal jobs, such as querying information about these internal jobs and listing all available jobs.
To our knowledge, this does not allow for data breaches, data loss, privilege escalation, or other concrete attacks, i.e. there is no immediate security impact. Nevertheless, we now limit unauthenticated users to launching these internal jobs (and nothing more), as was the intention when they were implemented.
Workaround
None.
Fix
Unauthenticated users can execute these internal jobs, but not query any additional information about them. In the future, we plan to get rid of these authentication exceptions completely, so that an unauthenticated user cannot launch any jobs anymore.
