Apache Pinot: Unauthorized endpoint exposed sensitive information

Apache Pinot · Information exposure · CWE-200

AffectedApache Pinot

FixUpdate to 1.0.0 or newer

PublishedJul 24, 2024, 07:41 · apache

Scored7.5 · CISA

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

A successful attack can read data. CVSS impact.

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/appconfigs” to the controller, it can lead to the disclosure of sensitive information such as system information (e.g. arch, os version), environment information (e.g. maxHeapSize) and Pinot configurations (e.g. zookeeper path). This issue was addressed by the Role-based Access Control https://docs.pinot.apache.org/operators/tutorials/authentication/basic-auth-access-control , so that /appConfigs` and all other APIs can be access controlled. Only authorized users have access to it. Note the user needs to add the admin role accordingly to the RBAC guide to control access to this endpoint, and in the future version of Pinot, a default admin role is planned to be added.

From apache

Affected and fixed versions

ProductAffectedFixed inApache Pinot0.1 – before 1.0.01.0.0

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

lists.apache.org/thread/hsm0b2w8qr0sqy4rj1mfnnw286tslpzc · lists.apache.orgvendor advisory

Other CVEs in Apache Pinot

All 3 →

–Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup() · CVE-2026-73322Oct 30 9.8Pinot query endpoint and the realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support · CVE-2022-26112Sep 23, 2022 7.5Pinot segment push endpoint has a vulnerability in unprotected environments · CVE-2022-23974Apr 5, 2022