[
https://issues.apache.org/jira/browse/ATLAS-5421?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mandar Ambawane updated ATLAS-5421:
-----------------------------------
Description:
h2. Issue 1: File Existence Oracle
h3. Description
The endpoint returns distinguishable error responses depending on whether the
supplied path exists on the server, allowing an attacker to enumerate readable
files on the Atlas host.
h3. Behavior
When {{POST /api/atlas/admin/importfile}} is called with a JSON body containing
{{{}fileName{}}}:
* Non-existent path: Returns an error such as:
*
** {{invalid parameters: <path>: file not found}}
** Thrown from {{ImportService.java}} on {{FileNotFoundException}}
* Existing path that is not a valid ZIP archive (e.g. {{{}/etc/passwd{}}}):
Returns a different error such as:
*
** {{Attempting to import empty ZIP file.}}
** Thrown from {{ZipSourceWithBackingDirectory.java}} /
{{AtlasErrorCode.IMPORT_ATTEMPTING_EMPTY_ZIP}}
Because these two error messages are distinct and reliably mappable to file
state, an attacker with {{ADMIN_IMPORT}} access can probe arbitrary paths and
infer which files exist and are readable by the Atlas process.
h3. Impact
* Enumeration of readable filesystem paths on the Atlas server
* Information disclosure about server layout, configuration files, and
sensitive paths
* Useful as reconnaissance for further attacks
h3. Example Request
{code:java}
POST /api/atlas/admin/importfile
Content-Type: application/json
{
"fileName": "/etc/passwd"
}{code}
h2. Issue 2: Arbitrary Path Read / Content Disclosure via ZIP Import
h3. Description
The endpoint accepts any absolute or relative server-local path in {{fileName}}
and attempts to read and parse it as an Atlas export ZIP archive. There is no
restriction to a configured import directory, no path canonicalization, and no
allowlist of permitted locations.
h3. Behavior
When {{fileName}} points to a valid ZIP-structured file anywhere on the
filesystem that the Atlas process can read:
# The server opens the file directly using {{new File(fileName)}} and {{new
FileInputStream(file)}}
# The ZIP contents are parsed and processed as an Atlas import
# Import results — including entity metrics and parsed contents — are returned
in the {{AtlasImportResult}} response
This means any readable ZIP file on the host (Atlas export archives, backups,
or other ZIP artifacts) can be imported and its contents reflected in the API
response, even if the file was never placed in an intended import location.
h3. Impact
* Read/import of ZIP files from arbitrary filesystem locations accessible to
Atlas
* Disclosure of metadata and entity contents from Atlas export archives stored
outside the intended import directory
* Potential exposure of sensitive backup or export data placed elsewhere on
the server
h3. Example Request
{code:java}
POST /api/atlas/admin/importfile
Content-Type: application/json
{
"fileName": "/var/backups/atlas-export.zip"
}{code}
was:
h3. Description
The endpoint returns distinguishable error responses depending on whether the
supplied path exists on the server, allowing an attacker to enumerate readable
files on the Atlas host.
h3. Behavior
When {{POST /api/atlas/admin/importfile}} is called with a JSON body containing
{{{}fileName{}}}:
* Non-existent path: Returns an error such as:
** {{invalid parameters: <path>: file not found}}
** Thrown from {{ImportService.java}} on {{FileNotFoundException}}
* Existing path that is not a valid ZIP archive (e.g. {{{}/etc/passwd{}}}):
Returns a different error such as:
** {{Attempting to import empty ZIP file.}}
** Thrown from {{ZipSourceWithBackingDirectory.java}} /
{{AtlasErrorCode.IMPORT_ATTEMPTING_EMPTY_ZIP}}
Because these two error messages are distinct and reliably mappable to file
state, an attacker with {{ADMIN_IMPORT}} access can probe arbitrary paths and
infer which files exist and are readable by the Atlas process.
h3. Impact
* Enumeration of readable filesystem paths on the Atlas server
* Information disclosure about server layout, configuration files, and
sensitive paths
* Useful as reconnaissance for further attacks
h3. Example Request
{code:java}
POST /api/atlas/admin/importfile
Content-Type: application/json
{
"fileName": "/etc/passwd"
}{code}
h2. Issue 2: Arbitrary Path Read / Content Disclosure via ZIP Import
h3. Description
The endpoint accepts any absolute or relative server-local path in {{fileName}}
and attempts to read and parse it as an Atlas export ZIP archive. There is no
restriction to a configured import directory, no path canonicalization, and no
allowlist of permitted locations.
h3. Behavior
When {{fileName}} points to a valid ZIP-structured file anywhere on the
filesystem that the Atlas process can read:
# The server opens the file directly using {{new File(fileName)}} and {{new
FileInputStream(file)}}
# The ZIP contents are parsed and processed as an Atlas import
# Import results — including entity metrics and parsed contents — are returned
in the {{AtlasImportResult}} response
This means any readable ZIP file on the host (Atlas export archives, backups,
or other ZIP artifacts) can be imported and its contents reflected in the API
response, even if the file was never placed in an intended import location.
h3. Impact
* Read/import of ZIP files from arbitrary filesystem locations accessible to
Atlas
* Disclosure of metadata and entity contents from Atlas export archives stored
outside the intended import directory
* Potential exposure of sensitive backup or export data placed elsewhere on
the server
h3. Example Request
{code:java}
POST /api/atlas/admin/importfile
Content-Type: application/json
{
"fileName": "/var/backups/atlas-export.zip"
}{code}
> Arbitrary file existence oracle and arbitrary path read via POST
> /api/atlas/admin/importfile
> --------------------------------------------------------------------------------------------
>
> Key: ATLAS-5421
> URL: https://issues.apache.org/jira/browse/ATLAS-5421
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Reporter: Mandar Ambawane
> Assignee: Mandar Ambawane
> Priority: Major
>
> h2. Issue 1: File Existence Oracle
> h3. Description
> The endpoint returns distinguishable error responses depending on whether the
> supplied path exists on the server, allowing an attacker to enumerate
> readable files on the Atlas host.
> h3. Behavior
> When {{POST /api/atlas/admin/importfile}} is called with a JSON body
> containing {{{}fileName{}}}:
> * Non-existent path: Returns an error such as:
> *
> ** {{invalid parameters: <path>: file not found}}
> ** Thrown from {{ImportService.java}} on {{FileNotFoundException}}
> * Existing path that is not a valid ZIP archive (e.g. {{{}/etc/passwd{}}}):
> Returns a different error such as:
> *
> ** {{Attempting to import empty ZIP file.}}
> ** Thrown from {{ZipSourceWithBackingDirectory.java}} /
> {{AtlasErrorCode.IMPORT_ATTEMPTING_EMPTY_ZIP}}
> Because these two error messages are distinct and reliably mappable to file
> state, an attacker with {{ADMIN_IMPORT}} access can probe arbitrary paths and
> infer which files exist and are readable by the Atlas process.
> h3. Impact
> * Enumeration of readable filesystem paths on the Atlas server
> * Information disclosure about server layout, configuration files, and
> sensitive paths
> * Useful as reconnaissance for further attacks
> h3. Example Request
> {code:java}
> POST /api/atlas/admin/importfile
> Content-Type: application/json
> {
> "fileName": "/etc/passwd"
> }{code}
> h2. Issue 2: Arbitrary Path Read / Content Disclosure via ZIP Import
> h3. Description
> The endpoint accepts any absolute or relative server-local path in
> {{fileName}} and attempts to read and parse it as an Atlas export ZIP
> archive. There is no restriction to a configured import directory, no path
> canonicalization, and no allowlist of permitted locations.
> h3. Behavior
> When {{fileName}} points to a valid ZIP-structured file anywhere on the
> filesystem that the Atlas process can read:
> # The server opens the file directly using {{new File(fileName)}} and {{new
> FileInputStream(file)}}
> # The ZIP contents are parsed and processed as an Atlas import
> # Import results — including entity metrics and parsed contents — are
> returned in the {{AtlasImportResult}} response
> This means any readable ZIP file on the host (Atlas export archives, backups,
> or other ZIP artifacts) can be imported and its contents reflected in the API
> response, even if the file was never placed in an intended import location.
> h3. Impact
> * Read/import of ZIP files from arbitrary filesystem locations accessible to
> Atlas
> * Disclosure of metadata and entity contents from Atlas export archives
> stored outside the intended import directory
> * Potential exposure of sensitive backup or export data placed elsewhere on
> the server
> h3. Example Request
> {code:java}
> POST /api/atlas/admin/importfile
> Content-Type: application/json
> {
> "fileName": "/var/backups/atlas-export.zip"
> }{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
