Alluxio
Monthly
Identity spoofing and authentication bypass in Alluxio's S3 REST proxy (versions through 2.9.5) lets remote unauthenticated attackers impersonate any user because the proxy does not verify AWS Signature Version 4 signatures in its default configuration. By reading the username directly from an unsigned Authorization header, an attacker can assume the identity of arbitrary users and service accounts to read, write, and delete data. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Alluxio before 2.7.3, the logserver does not validate the input stream. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Identity spoofing and authentication bypass in Alluxio's S3 REST proxy (versions through 2.9.5) lets remote unauthenticated attackers impersonate any user because the proxy does not verify AWS Signature Version 4 signatures in its default configuration. By reading the username directly from an unsigned Authorization header, an attacker can assume the identity of arbitrary users and service accounts to read, write, and delete data. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio.util.CommonUtils.getUnixGroups(java.lang.String). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In Alluxio before 2.7.3, the logserver does not validate the input stream. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.