CVE-2024-39928
📋 TL;DR
Apache Linkis versions up to 1.5.0 use a cryptographically weak random string generator (Commons Lang's RandomStringUtils) for Py4j token generation in Spark EngineConn. This vulnerability could allow attackers to predict or brute-force authentication tokens, potentially leading to unauthorized access. All users running Apache Linkis ≤1.5.0 are affected.
💻 Affected Systems
- Apache Linkis
📦 What is this software?
Linkis by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could predict authentication tokens and gain unauthorized access to Spark EngineConn, potentially executing arbitrary code or accessing sensitive data within the Linkis environment.
Likely Case
Attackers with network access could brute-force or predict tokens to gain unauthorized access to Spark EngineConn functionality, leading to data exposure or limited system compromise.
If Mitigated
With proper network segmentation and access controls, impact would be limited to the Spark EngineConn component only.
🎯 Exploit Status
Exploitation requires understanding of the token generation mechanism and network access to Spark EngineConn.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.0
Vendor Advisory: https://lists.apache.org/thread/g664n13nb17rsogcfrn8kjgd8m89p8nw
Restart Required: Yes
Instructions:
1. Download Apache Linkis 1.6.0 from official Apache repository. 2. Stop all Linkis services. 3. Backup current installation. 4. Deploy version 1.6.0. 5. Restart all Linkis services. 6. Verify functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict network access to Spark EngineConn ports to trusted hosts only
iptables -A INPUT -p tcp --dport [SPARK_ENGINECONN_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [SPARK_ENGINECONN_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit connections to Spark EngineConn
- Monitor authentication logs for suspicious token usage patterns
🔍 How to Verify
Check if Vulnerable:
Check Linkis version: grep 'linkis.version' $LINKIS_HOME/conf/linkis.propertiesCheck Version:
grep 'linkis.version' $LINKIS_HOME/conf/linkis.propertiesVerify Fix Applied:
Verify version is 1.6.0 or higher and check that RandomStringUtils is not used for token generation in Spark EngineConn code📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with malformed tokens
- Multiple connection attempts to Spark EngineConn from single source
Network Indicators:
- Unusual traffic patterns to Spark EngineConn ports
- Connection attempts from unexpected IP addresses
SIEM Query:
source="linkis.logs" AND ("authentication failed" OR "invalid token") | stats count by src_ip