Executive Summary

This vulnerability exists because the frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. While unary RPCs enforce authentication and authorization when a ClaimMapper and Authorizer are configured, the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without requiring credentials.

This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. As a result, an attacker with network access to the frontend port could open the replication stream without authentication.

However, data exfiltration is only possible if a replication target is correctly configured and the attacker knows the cluster configuration, since the history service validates cluster IDs and peer membership before returning replication data.

Useful 0 Not Useful 0

Impact Analysis

An attacker with network access to the frontend port could exploit this vulnerability to open the replication stream without authentication.

This could lead to potential data exfiltration if the attacker has knowledge of the cluster configuration and if a replication target is properly configured.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized access to the streaming AdminService/StreamWorkflowReplicationMessages endpoint without authentication, potentially enabling data exfiltration if an attacker has network access and knowledge of the cluster configuration.

Such unauthorized data access and exfiltration could lead to non-compliance with data protection standards and regulations like GDPR and HIPAA, which require strict controls on access to sensitive data and proper authentication and authorization mechanisms.

However, the vulnerability is limited by the need for a correctly configured replication target and cluster configuration knowledge, and the history service validates cluster IDs and peer membership before returning replication data.

Useful 0 Not Useful 0