CVE-2023-25601
Apache DolphinScheduler 3.0.0-3.1.1: Unauthorized socket attacks. Fixed in 3.1.2
- CVSS 4.3
- CWE-287 Improper Authentication
- Authentication, Authorization, and Session Management
- Local
On version 3.0.0 through 3.1.1, Apache DolphinScheduler's python gateway suffered from improper authentication: an attacker could use a socket bytes attack without authentication. This issue has been fixed from version 3.1.2 onwards. For users who use version 3.0.0 to 3.1.1, you can turn off the python-gateway function by changing the value `python-gateway.enabled=false` in configuration file `application.yaml`. If you are using the python gateway, please upgrade to version 3.1.2 or above.
- CVSS base score
- 4.3
- Published
- 2023-04-20
- OWASP
- A07 Identification and Authentication Failures
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Authentication, Authorization, and Session Management
- Subcategory
- Insecure Authentication Mechanisms
- Accessibility scope
- Local
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Upgrade to Apache DolphinScheduler version 3.1.2 or higher.
Vulnerable code sample
import socket
class PythonGateway:
def __init__(self, host='localhost', port=8000):
self.host = host
self.port = port
self.server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.server_socket.bind((self.host, self.port))
self.server_socket.listen(5)
def handle_client(self, client_socket):
while True:
data = client_socket.recv(1024)
if not data:
break
self.process_data(data)
def process_data(self, data):
print(f"Received data: {data}")
def start(self):
print("Server is listening...")
while True:
client_socket, addr = self.server_socket.accept()
print(f"Accepted connection from {addr}")
self.handle_client(client_socket)
client_socket.close()
if __name__ == "__main__":
gateway = PythonGateway()
gateway.start()Patched code sample
import socket
import ssl
import re
class PythonGateway:
def __init__(self, host='localhost', port=8000):
self.host = host
self.port = port
self.server_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.server_socket.bind((self.host, self.port))
self.server_socket.listen(5)
self.authenticated_clients = set()
self.max_auth_attempts = 3
def authenticate_client(self, client_socket):
auth_attempts = 0
while auth_attempts < self.max_auth_attempts:
client_socket.sendall(b"Please send your authentication token:")
token = client_socket.recv(1024).strip()
if self.is_valid_token(token):
self.authenticated_clients.add(client_socket)
client_socket.sendall(b"Authentication successful!")
return True
else:
auth_attempts += 1
client_socket.sendall(b"Authentication failed! Try again.")
if auth_attempts >= self.max_auth_attempts:
client_socket.sendall(b"Too many failed attempts. Connection closed.")
client_socket.close()
return False
return False
def is_valid_token(self, token):
return token == b"valid_token"
def sanitize_data(self, data):
sanitized_data = re.sub(r'[\x00-\x1F\x7F]', '', data.decode(errors='ignore'))
sanitized_data = re.sub(r'<[^>]*>', '', sanitized_data)
sanitized_data = re.sub(r'[^a-zA-Z0-9\s.,!?;:()_-]', '', sanitized_data)
return sanitized_data
def handle_client(self, client_socket):
if not self.authenticate_client(client_socket):
return
while True:
data = client_socket.recv(1024)
if not data:
break
sanitized_data = self.sanitize_data(data)
self.process_data(sanitized_data)
client_socket.close()
def process_data(self, data):
print(f"Received and sanitized data: {data}")
def start(self):
print(f"Server listening on {self.host}:{self.port}")
while True:
client_socket, addr = self.server_socket.accept()
print(f"Accepted connection from {addr}")
secure_socket = ssl.wrap_socket(client_socket, keyfile=None, certfile="server.crt", server_side=True)
self.handle_client(secure_socket)
if __name__ == "__main__":
gateway = PythonGateway()
gateway.start()Cite this entry
@misc{vaitp:cve202325601,
title = {{Apache DolphinScheduler 3.0.0-3.1.1: Unauthorized socket attacks. Fixed in 3.1.2}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2023},
note = {VAITP Python Vulnerability Dataset, entry CVE-2023-25601},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-25601/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::