CVE-2024-45627
📋 TL;DR
This vulnerability in Apache Linkis allows authenticated attackers to read arbitrary files from the server by injecting malicious MySQL JDBC parameters. It affects Apache Linkis versions before 1.7.0. Attackers need valid credentials to exploit this vulnerability.
💻 Affected Systems
- Apache Linkis
📦 What is this software?
Linkis by Apache
⚠️ Risk & Real-World Impact
Worst Case
Sensitive server files including configuration files, credentials, and system files could be exfiltrated, potentially leading to full system compromise.
Likely Case
Attackers with legitimate access could read configuration files containing database credentials, API keys, or other sensitive information stored on the Linkis server.
If Mitigated
With proper access controls and monitoring, impact would be limited to files accessible by the Linkis service account.
🎯 Exploit Status
Exploitation requires authenticated access but is technically simple once credentials are obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.0
Vendor Advisory: https://lists.apache.org/thread/0zzx8lldwoqgzq98mg61hojgpvn76xsh
Restart Required: Yes
Instructions:
1. Download Apache Linkis 1.7.0 or later from official Apache repository. 2. Stop Linkis services. 3. Backup current configuration. 4. Deploy new version. 5. Restart Linkis services.
🔧 Temporary Workarounds
MySQL JDBC Parameter Filtering
allImplement input validation to filter or block malicious MySQL JDBC parameters in DataSource Manager Module
Access Restriction
allRestrict DataSource Manager Module access to only trusted users who require MySQL database connectivity
🧯 If You Can't Patch
- Implement strict access controls and monitoring for DataSource Manager Module operations
- Apply network segmentation to isolate Linkis servers from sensitive file storage
🔍 How to Verify
Check if Vulnerable:
Check Linkis version using administrative interface or configuration filesCheck Version:
Check linkis.properties or Linkis web interface for version informationVerify Fix Applied:
Verify Linkis version is 1.7.0 or higher and test MySQL JDBC parameter injection attempts are blocked📡 Detection & Monitoring
Log Indicators:
- Unusual MySQL JDBC connection attempts with suspicious parameters
- Multiple file read operations from unexpected locations
Network Indicators:
- Unexpected outbound file transfers from Linkis servers
SIEM Query:
source="linkis" AND (jdbc OR mysql) AND (parameter OR config) AND (read OR file)