Authorization Bypass in Apache DolphinScheduler

Executive Summary

This is an authorization vulnerability in Apache DolphinScheduler where authenticated users can access other users' account information without proper permissions. The /dolphinscheduler/users/list-all endpoint fails to enforce authorization checks, allowing unauthorized access to sensitive data.

Useful 0 Not Useful 0

Detection Guidance

Check if the /dolphinscheduler/users/list-all endpoint is accessible without proper authorization. Use curl to test the endpoint: curl -u username:password http://<target>/dolphinscheduler/users/list-all. If it returns user data without errors, the system may be vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials could exploit this to retrieve other users' account details, leading to potential data breaches, identity theft, or further attacks like account enumeration. Users should upgrade to version 3.4.3 or later to mitigate this risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's privacy rules. Organizations must address it to maintain compliance and avoid legal penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Apache DolphinScheduler to version 3.4.3 or later immediately. Ensure no unauthorized access has occurred by reviewing logs for suspicious requests to the /dolphinscheduler/users/list-all endpoint.

Useful 0 Not Useful 0