Linkis
CVE-2023-27602
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types.
We recommend users upgrade the version of Linkis to version 1.3.2.
For versions
<=1.3.1, we suggest turning on the file path check switch in linkis.properties
wds.linkis.workspace.filesystem.owner.check=true wds.linkis.workspace.filesystem.path.check=true
AnalysisAI
In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. In Apache Linkis <=1.3.1, The PublicService module uploads files without restrictions on the path to the uploaded files, and file types. We recommend users upgrade the version of Linkis to version 1.3.2. For versions <=1.3.1, we suggest turning on the file path check switch in linkis.properties wds.linkis.workspace.filesystem.owner.check=true wds.linkis.workspace.filesystem.path.check=true Affected products include: Apache Linkis. Version information: version 1.3.2..
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.
In Apache Linkis <=1.3.1, because the parameters are not effectively filtered, the attacker uses the MySQL data source a
In Apache Linkis <=1.3.1, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql
In Apache Linkis <=1.3.1, due to the Manager module engineConn material upload does not check the zip path, This is a Zi
In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy f
In Apache Linkis <= 1.5.0, Privilege Escalation in Basic management services where the attacking user is a trusted accou
In Apache Linkis <=1.2.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code
A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and d
In Apache Linkis <= 1.5.0, a Random string security vulnerability in Spark EngineConn, random string generated by the To
A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records th
In Apache Linkis <= 1.5.0, Arbitrary file deletion in Basic management services on A user with an administrator account
In Apache Linkis <1.7.0, due to the lack of effective filtering of parameters, an attacker configuring malicious Mysql J
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today