ArcadeDB Function Library Tampering via Missing Permission Check

Executive Summary

ArcadeDB versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an existing function library. This allows users with only database access to add or overwrite SQL or Cypher functions in an existing library, enabling tampering with admin-defined function logic.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check ArcadeDB server logs for DEFINE FUNCTION commands targeting existing function libraries. Look for unauthorized modifications to SQL or Cypher functions. Verify if users without UPDATE_SCHEMA permissions executed such commands. Compare current function libraries against known admin-defined versions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with database access could replace or modify admin-defined functions, altering database logic. This could lead to unauthorized data manipulation, privilege escalation, or other malicious activities depending on the functions affected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could compromise data integrity and access controls, which are critical for GDPR and HIPAA compliance. Unauthorized function modifications may lead to violations of confidentiality, integrity, and availability requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade ArcadeDB to version 26.8.1 or later. Review all function libraries for unauthorized changes. Revoke unnecessary database access permissions. Monitor for suspicious DEFINE FUNCTION commands in logs. Implement strict permission checks for all schema modifications.

Useful 0 Not Useful 0