CVE-2025-68637
📋 TL;DR
This vulnerability allows attackers to perform Man-in-the-Middle attacks on all REST API communications between Uniffle CLI/client and Coordinator service due to insecure SSL configuration. It affects all Uniffle users with versions before 0.10.0, exposing sensitive data and potentially allowing unauthorized access.
💻 Affected Systems
- Apache Uniffle
📦 What is this software?
Uniffle by Apache
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of Uniffle cluster with data interception, modification, and unauthorized administrative access to the Coordinator service.
Likely Case
Interception of sensitive configuration data, authentication credentials, and job execution details transmitted between CLI and Coordinator.
If Mitigated
Limited impact if network segmentation prevents MITM positioning or if alternative secure communication channels are used.
🎯 Exploit Status
Exploitation requires network access to intercept traffic but no authentication to Uniffle services. Standard SSL stripping tools can be used.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.10.0
Vendor Advisory: https://lists.apache.org/thread/trvdd11hmpbjno3t8rc9okr4t036ox2v
Restart Required: Yes
Instructions:
1. Download Uniffle 0.10.0 from official Apache repository. 2. Stop all Uniffle services. 3. Replace existing installation with 0.10.0. 4. Restart Coordinator and all client services. 5. Verify SSL certificate validation is now enforced.
🔧 Temporary Workarounds
Configure custom SSL context
allOverride default SSL configuration to enforce certificate validation and hostname verification
Configure Uniffle client with custom SSLContext that sets TrustManager to validate certificates and enables hostname verification
Network segmentation
allIsolate Uniffle Coordinator and clients in protected network segments
Implement firewall rules to restrict access to Coordinator service (default port 19998) to trusted networks only
🧯 If You Can't Patch
- Deploy network-level TLS termination with proper certificate validation using reverse proxy
- Implement certificate pinning at application layer to validate Coordinator certificates
🔍 How to Verify
Check if Vulnerable:
Check Uniffle client configuration for SSL certificate validation settings. If 'ssl.trust.all.certificates' is true or hostname verification is disabled, system is vulnerable.Check Version:
uniffle version or check pom.xml for version < 0.10.0Verify Fix Applied:
Attempt to connect to Coordinator with invalid SSL certificate - connection should fail. Verify client logs show certificate validation errors for invalid certs.📡 Detection & Monitoring
Log Indicators:
- SSL handshake failures with self-signed certificates after patch
- Unexpected client connections from unusual network segments
Network Indicators:
- Unencrypted HTTP traffic to Coordinator port 19998
- SSL connections without certificate validation
SIEM Query:
source="uniffle" AND (event="SSL_ERROR" OR event="CERTIFICATE_VALIDATION_FAILED")