Starrocks
Monthly
Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete legacy synchronous materialized views across all databases, regardless of grants. The flaw exists because `AuthorizerStmtVisitor.visitDropMaterializedViewStatement` exits early without invoking the Authorizer; the authorization branch executes only when the resolved object is a modern `MaterializedView`, not when it is a legacy synchronous view stored as a rollup index on an `OlapTable`. Versions through 4.0.13 are affected per the VulnCheck advisory, and no public exploit has been identified at time of analysis.
StarRocks through version 4.0.13 exposes complete query history for all users to any authenticated low-privilege user via the unguarded query_detail REST endpoint. The endpoint returns full SQL text, execution plans, and profiling data without filtering by the requesting user's identity, meaning statements containing embedded credentials - connection strings, passwords passed as query parameters - are fully readable by any logged-in account. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low authentication bar (any valid account) and high confidentiality impact make this a meaningful lateral-movement and credential-harvesting risk in multi-tenant or shared StarRocks deployments.
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate cluster topology, database metadata, JVM statistics, and version information without credentials, affecting all releases through 4.0.13. Five REST handler classes in the FE component override execute() directly rather than implementing executeWithoutPassword(), inadvertently bypassing the authentication gate enforced by the RestBaseAction base class. No public exploit code or active exploitation has been confirmed at time of analysis; however, the reconnaissance value of the disclosed data materially reduces the effort required for targeted follow-on attacks against the same infrastructure.
Missing authorization on DROP MATERIALIZED VIEW in StarRocks allows any authenticated account to permanently delete legacy synchronous materialized views across all databases, regardless of grants. The flaw exists because `AuthorizerStmtVisitor.visitDropMaterializedViewStatement` exits early without invoking the Authorizer; the authorization branch executes only when the resolved object is a modern `MaterializedView`, not when it is a legacy synchronous view stored as a rollup index on an `OlapTable`. Versions through 4.0.13 are affected per the VulnCheck advisory, and no public exploit has been identified at time of analysis.
StarRocks through version 4.0.13 exposes complete query history for all users to any authenticated low-privilege user via the unguarded query_detail REST endpoint. The endpoint returns full SQL text, execution plans, and profiling data without filtering by the requesting user's identity, meaning statements containing embedded credentials - connection strings, passwords passed as query parameters - are fully readable by any logged-in account. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low authentication bar (any valid account) and high confidentiality impact make this a meaningful lateral-movement and credential-harvesting risk in multi-tenant or shared StarRocks deployments.
Unauthenticated access to six REST endpoints on StarRocks' frontend HTTP port allows remote attackers to enumerate cluster topology, database metadata, JVM statistics, and version information without credentials, affecting all releases through 4.0.13. Five REST handler classes in the FE component override execute() directly rather than implementing executeWithoutPassword(), inadvertently bypassing the authentication gate enforced by the RestBaseAction base class. No public exploit code or active exploitation has been confirmed at time of analysis; however, the reconnaissance value of the disclosed data materially reduces the effort required for targeted follow-on attacks against the same infrastructure.