CVE-2023-25558
📋 TL;DR
DataHub's SSO authentication improperly processes id_token claims with {#sb64} prefixes, allowing unsafe Java deserialization via pac4j library. This vulnerability can lead to remote code execution when exploited. All DataHub instances using SSO authentication are affected.
💻 Affected Systems
- DataHub
📦 What is this software?
Datahub by Datahub Project
⚠️ Risk & Real-World Impact
Worst Case
Remote Code Execution (RCE) allowing full system compromise, data theft, and lateral movement within the environment.
Likely Case
RCE leading to unauthorized access, data exfiltration, and potential deployment of malware or persistence mechanisms.
If Mitigated
Limited impact if network segmentation restricts access and monitoring detects exploitation attempts early.
🎯 Exploit Status
Exploitation requires SSO access and crafting malicious id_token claims with {#sb64} prefixes. The RestrictedObjectInputStream reduces but doesn't eliminate exploitability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions including commit 2a182f484677d056730d6b4e9f0143e67368359f
Vendor Advisory: https://github.com/datahub-project/datahub/security/advisories/GHSA-hrwp-2q5c-86wv
Restart Required: Yes
Instructions:
1. Update DataHub to latest version or version containing fix commit 2a182f484677d056730d6b4e9f0143e67368359f. 2. Restart DataHub services. 3. Verify SSO authentication still functions correctly.
🧯 If You Can't Patch
- Disable SSO authentication and use alternative authentication methods if possible.
- Implement strict network segmentation to isolate DataHub instances from critical systems.
🔍 How to Verify
Check if Vulnerable:
Check if DataHub version is older than commit 2a182f484677d056730d6b4e9f0143e67368359f and SSO authentication is enabled.Check Version:
Check DataHub deployment configuration or container tags for version information.Verify Fix Applied:
Verify DataHub version includes commit 2a182f484677d056730d6b4e9f0143e67368359f and test SSO authentication functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual Java deserialization errors in DataHub logs
- SSO authentication failures with malformed tokens
- Unexpected process spawns from DataHub services
Network Indicators:
- Unusual outbound connections from DataHub instances
- SSO token payloads containing {#sb64} prefixes
SIEM Query:
source="datahub" AND ("deserialization" OR "id_token" OR "{#sb64}")🔗 References
- https://github.com/datahub-project/datahub/commit/2a182f484677d056730d6b4e9f0143e67368359f
- https://github.com/datahub-project/datahub/security/advisories/GHSA-hrwp-2q5c-86wv
- https://github.com/datahub-project/datahub/commit/2a182f484677d056730d6b4e9f0143e67368359f
- https://github.com/datahub-project/datahub/security/advisories/GHSA-hrwp-2q5c-86wv
