Path Traversal in Apache IoTDB DataNode RPC Interface

Executive Summary

This vulnerability exists in Apache IoTDB DataNode’s internal RPC interface used for creating Trigger instances. The issue arises because the system uses the uploaded Trigger JAR file name to build a file path without properly validating it. If the internal DataNode RPC port is exposed to an untrusted network, an attacker can exploit this by including path traversal sequences in the JAR name.

This allows the attacker to write files outside the intended Trigger installation directory, effectively enabling arbitrary file write operations with the permissions of the IoTDB process.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to an attacker writing arbitrary files on the system where Apache IoTDB is running. Since the attacker can write files outside the intended directory with the same permissions as the IoTDB process, this could lead to unauthorized modification or insertion of malicious files.

Such unauthorized file writes can compromise system integrity, potentially allowing further exploitation, data corruption, or disruption of service.

Useful 0 Not Useful 0

Mitigation Strategies

Users are recommended to upgrade Apache IoTDB to version 2.0.8, which fixes the vulnerability.

Additionally, ensure that the internal DataNode RPC port is not exposed to untrusted networks to prevent exploitation via path traversal sequences in the Trigger JAR name.

Useful 0 Not Useful 0