GHSA-cp2c-x2pc-fph7

Apache SeaTunnel Web Authentication vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-48396

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.seatunnel:seatunnel-web	< 1.0.1	1.0.1

Details

As written in the advisory (Markdown source, shown as plain text).

Web Authentication vulnerability in Apache SeaTunnel. Since the jwt key is hardcoded in the application, an attacker can forge any token to log in any user. Attacker can get secret key in /seatunnel-server/seatunnel-app/src/main/resources/application.yml and then create a token. This issue affects Apache SeaTunnel: 1.0.0. Users are recommended to upgrade to version 1.0.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-48396 advisory
https://github.com/apache/seatunnel-web/commit/4a37ebfa4b57e177bf7857cf39a6dbdc00f75f78 web
https://github.com/apache/seatunnel package
https://lists.apache.org/thread/1tdxfjksx0vb9gtyt77wlr6rdcy1qwmw web
http://www.openwall.com/lists/oss-security/2024/07/30/1 web