[
https://issues.apache.org/jira/browse/ATLAS-5365?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Umesh Patil updated ATLAS-5365:
-------------------------------
Description:
The rest-notification-webapp module (introduced in ATLAS-5207 / PR #622) is
missing authorization on the Kafka hook notification REST endpoint POST
/api/atlas/v2/notification/topic/\{topicName}. The main webapp NotificationREST
already enforces SERVICE_NOTIFICATION_POST via
AtlasAuthorizationUtils.verifyAccess(), but the rest-notification copy did not
— allowing authenticated read-only users (e.g. DATA_SCIENTIST / rangertagsync)
to POST hook messages (including ENTITY_CREATE_V2) to ATLAS_HOOK and reach the
entity pipeline via Kafka.
h2. Related work
* Parent feature JIRA:
[ATLAS-5207|https://issues.apache.org/jira/browse/ATLAS-5207] (Closed —
rest-notification module port)
* Merged PR: [GitHub PR #622|https://github.com/apache/atlas/pull/622]
* Webapp reference (correct behavior):
webapp/src/main/java/org/apache/atlas/web/rest/NotificationREST.java line ~91
h2. Problem (before fix)
|| Entry point || Authorization ||
| webapp NotificationREST | verifyAccess(SERVICE_NOTIFICATION_POST) — OK |
| rest-notification NotificationREST | Missing verifyAccess — VULNERABLE |
*Attack path:* Read-only user authenticates to rest-notification server (port
41000) → POST ENTITY_CREATE_V2 JSON to
/rest/api/atlas/v2/notification/topic/ATLAS_HOOK → message published to Kafka →
main Atlas consumer processes entity create/update/delete.
*Root cause:* Authorization check existed in webapp since ATLAS-4335 but was
never added when rest-notification was created (CDH CDPD-45331, Nov 2022) or
when ported to Apache OSS (commit 8427a05, ATLAS-5207). Commit 573f23e only
removed unused auth imports during checkstyle cleanup — it did not remove
working authorization (verifyAccess was never implemented in the method body).
> Missing SERVICE_NOTIFICATION_POST authorization on rest-notification
> NotificationREST POST /topic/{topicName}.
> --------------------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5365
> URL: https://issues.apache.org/jira/browse/ATLAS-5365
> Project: Atlas
> Issue Type: Bug
> Components: atlas-core
> Affects Versions: 3.0.0
> Reporter: Umesh Patil
> Assignee: Umesh Patil
> Priority: Major
> Fix For: 3.0.0
>
>
> The rest-notification-webapp module (introduced in ATLAS-5207 / PR #622) is
> missing authorization on the Kafka hook notification REST endpoint POST
> /api/atlas/v2/notification/topic/\{topicName}. The main webapp
> NotificationREST already enforces SERVICE_NOTIFICATION_POST via
> AtlasAuthorizationUtils.verifyAccess(), but the rest-notification copy did
> not — allowing authenticated read-only users (e.g. DATA_SCIENTIST /
> rangertagsync) to POST hook messages (including ENTITY_CREATE_V2) to
> ATLAS_HOOK and reach the entity pipeline via Kafka.
>
> h2. Related work
> * Parent feature JIRA:
> [ATLAS-5207|https://issues.apache.org/jira/browse/ATLAS-5207] (Closed —
> rest-notification module port)
> * Merged PR: [GitHub PR #622|https://github.com/apache/atlas/pull/622]
> * Webapp reference (correct behavior):
> webapp/src/main/java/org/apache/atlas/web/rest/NotificationREST.java line ~91
> h2. Problem (before fix)
> || Entry point || Authorization ||
> | webapp NotificationREST | verifyAccess(SERVICE_NOTIFICATION_POST) — OK |
> | rest-notification NotificationREST | Missing verifyAccess — VULNERABLE |
> *Attack path:* Read-only user authenticates to rest-notification server (port
> 41000) → POST ENTITY_CREATE_V2 JSON to
> /rest/api/atlas/v2/notification/topic/ATLAS_HOOK → message published to Kafka
> → main Atlas consumer processes entity create/update/delete.
> *Root cause:* Authorization check existed in webapp since ATLAS-4335 but was
> never added when rest-notification was created (CDH CDPD-45331, Nov 2022) or
> when ported to Apache OSS (commit 8427a05, ATLAS-5207). Commit 573f23e only
> removed unused auth imports during checkstyle cleanup — it did not remove
> working authorization (verifyAccess was never implemented in the method body).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
