Alluxio S3 REST Proxy AWS Signature Spoofing Vulnerability

Executive Summary

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures by default. This allows unauthenticated attackers to spoof user identities by extracting usernames from unsigned Authorization headers and impersonating any user, including service accounts. Attackers can then read, write, or delete arbitrary data without proper authentication.

Useful 0 Not Useful 0

Detection Guidance

Check if Alluxio S3 REST Proxy is running and verify if AWS Signature Version 4 verification is disabled. Inspect Alluxio configuration files for the setting alluxio.s3.rest.authentication.enabled set to false. Monitor network traffic for unsigned S3 REST API requests with Authorization headers containing arbitrary usernames.

Useful 0 Not Useful 0

Impact Analysis

Attackers can impersonate any user to gain unauthorized access to data, including sensitive or confidential files. They can read, modify, or delete data, potentially leading to data breaches, loss of critical information, or full control over the Alluxio cluster if the impersonated user has superuser access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access and data breaches, violating compliance requirements for GDPR (data protection), HIPAA (healthcare data), and other regulations. It undermines data integrity, confidentiality, and access controls, potentially resulting in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Enable AWS Signature Version 4 verification by setting alluxio.s3.rest.authentication.enabled to true in Alluxio configuration. Restart the S3 REST Proxy service to apply changes. Review and restrict access permissions for all users and service accounts to minimize potential impact.

Useful 0 Not Useful 0