rdblue opened a new issue, #16492:
URL: https://github.com/apache/iceberg/issues/16492
> This issue was reported to the private Apache Iceberg security mailing
list. The submitter is being kept anonymous because the report was sent to a
private list. After review, the issue is not considered a serious vulnerability
that needs to be kept private, so it is being filed publicly here for tracking
and resolution.
>
> Note: this submission was generated by AI. Please review its claims and
source references carefully before acting on them.
# Summary
Spark `remove_orphan_files` accepts arbitrary cleanup roots and
deletes with the table FileIO credentials, so it can act as a
generalized delete primitive.
# Affected Maven coordinates
* versioned integration artifacts:
`org.apache.iceberg:iceberg-spark-3.4_*`,
`org.apache.iceberg:iceberg-spark-3.5_*`,
`org.apache.iceberg:iceberg-spark-4.0_2.13`,
`org.apache.iceberg:iceberg-spark-4.1_2.13`
# Attacker prerequisites
* ability to call the affected maintenance, DDL, or cleanup path
* a deployment where that caller should not be able to target the
broader resource set that the current code allows
# Impact
* A caller who can execute `CALL
<catalog>.system.remove_orphan_files(...)` can direct Iceberg to list
and delete files anywhere reachable by the table's `FileIO`, not just
under the table root.
* This is only safe if procedure access is already restricted to
trusted storage operators.
The Spark module itself does not enforce that boundary.
# Proof status
I reproduced this locally with a targeted reproducer or exploit.
The observed result matches the trigger and impact described above.
# Key source references
* org.apache.iceberg.spark.procedures.RemoveOrphanFilesProcedure
* org.apache.iceberg.spark.actions.DeleteOrphanFilesSparkAction
Current severity assessment [2]: Important
[1] https://iceberg.apache.org/security/
[2] https://security.apache.org/blog/severityrating/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
