[
https://issues.apache.org/jira/browse/KYLIN-6118?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
liyang closed KYLIN-6118.
-------------------------
> Potential unauthorized internal job-report RPC issue
> ----------------------------------------------------
>
> Key: KYLIN-6118
> URL: https://issues.apache.org/jira/browse/KYLIN-6118
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Assignee: liyang
> Priority: Major
> Fix For: 5.0.5
>
>
> Several internal job progress-report RPC operations are exposed on the public
> API port and are marked as public in the security chain, but they do not
> verify the caller identity or authorization. A caller that knows a running
> job identifier and its running-start value can submit forged progress, error,
> stage-status, and wait/run-time updates to job metadata.
> The affected operations are the internal job progress-report RPC endpoints
> under the job controller.
> Fix direction: require either an authenticated global administrator or a
> valid internal service credential on these internal RPC operations, and have
> the internal job-progress reporter send the credential.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
