CVE-2023-27987
📋 TL;DR
Apache Linkis versions up to 1.3.1 use a default authentication token that is too simple and predictable, allowing attackers to easily guess or obtain it. This vulnerability enables unauthorized access to the Linkis Gateway, potentially compromising the entire data processing platform. All deployments using default configurations are affected.
💻 Affected Systems
- Apache Linkis
📦 What is this software?
Linkis by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, access sensitive data, and take control of the entire Linkis data processing environment.
Likely Case
Unauthorized access to Linkis Gateway leading to data exfiltration, service disruption, and privilege escalation within the data platform.
If Mitigated
Minimal impact if custom strong tokens are already configured or if network access is properly restricted.
🎯 Exploit Status
Exploitation requires guessing or obtaining the default token, which is trivial due to its simplicity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.2
Vendor Advisory: https://lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p
Restart Required: Yes
Instructions:
1. Upgrade Apache Linkis to version 1.3.2 or later. 2. Modify the default token value in configuration. 3. Restart Linkis services. 4. Refer to Token authorization documentation at https://linkis.apache.org/docs/latest/auth/token
🔧 Temporary Workarounds
Change Default Token
allManually configure a strong, random token instead of using the default
Edit linkis.properties: set wds.linkis.gateway.access.token=<strong_random_token>
Restart Linkis Gateway service
🧯 If You Can't Patch
- Implement network segmentation to restrict access to Linkis Gateway
- Deploy Web Application Firewall (WAF) with authentication bypass protection
🔍 How to Verify
Check if Vulnerable:
Check if using Linkis version <=1.3.1 with default token configurationCheck Version:
Check Linkis version in web interface or configuration filesVerify Fix Applied:
Verify Linkis version is >=1.3.2 and custom token is configured in linkis.properties📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with default tokens
- Unauthorized access patterns to Gateway endpoints
Network Indicators:
- Unusual API calls to Linkis Gateway without proper authentication
SIEM Query:
source="linkis" AND (event_type="authentication_failure" OR event_type="unauthorized_access")