Path Traversal in Apache Kyuubi REST Batch Upload

Executive Summary

This vulnerability involves Apache Kyuubi's REST batch multipart upload handling. The server uses the client-supplied multipart filename to create temporary uploaded resources. An attacker can exploit this by including path traversal sequences in the filename to write files outside the intended upload directory, subject to filesystem permissions.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves path traversal in Apache Kyuubi's REST batch upload endpoint. To detect it, monitor for unusual file writes outside the intended upload directory or unexpected network requests to the REST batch upload endpoint. Check Kyuubi server logs for suspicious filenames containing path traversal sequences like '../'. Ensure Kyuubi is updated to version 1.12.0 or later to mitigate the issue.

Useful 0 Not Useful 0

Impact Analysis

If you are running Apache Kyuubi versions 1.7.0 through 1.11.1, a remote attacker could potentially write malicious files to arbitrary locations on your server. This could lead to unauthorized code execution, data corruption, or further compromise of your system, depending on filesystem permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file writes outside intended directories. If exploited, it may lead to unauthorized data access, modification, or exfiltration, violating data protection requirements for personal or sensitive health information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache Kyuubi to version 1.12.0 or later to fix the path traversal issue in REST batch multipart upload handling.

Useful 0 Not Useful 0