[
https://issues.apache.org/jira/browse/ATLAS-5421?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mandar Ambawane updated ATLAS-5421:
-----------------------------------
Summary: Prevent admin /api/atlas/admin/importfile from reading arbitrary
server files and enumerating filesystem paths (was: Arbitrary file existence
oracle and arbitrary path read via POST /api/atlas/admin/importfile)
> Prevent admin /api/atlas/admin/importfile from reading arbitrary server files
> and enumerating filesystem paths
> --------------------------------------------------------------------------------------------------------------
>
> Key: ATLAS-5421
> URL: https://issues.apache.org/jira/browse/ATLAS-5421
> Project: Atlas
> Issue Type: Improvement
> Components: atlas-core
> Reporter: Mandar Ambawane
> Assignee: Mandar Ambawane
> Priority: Major
>
> h2. Issue 1: File Existence
> h3. Description
> The endpoint returns distinguishable error responses depending on whether the
> supplied path exists on the server, allowing an attacker to enumerate
> readable files on the Atlas host.
> h3. Behavior
> When {{POST /api/atlas/admin/importfile}} is called with a JSON body
> containing {{{}fileName{}}}:
> * Non-existent path: Returns an error such as:
> *
> ** {{invalid parameters: <path>: file not found}}
> ** Thrown from {{ImportService.java}} on {{FileNotFoundException}}
> * Existing path that is not a valid ZIP archive (e.g. {{{}/etc/passwd{}}}):
> Returns a different error such as:
> *
> ** {{Attempting to import empty ZIP file.}}
> ** Thrown from {{ZipSourceWithBackingDirectory.java}} /
> {{AtlasErrorCode.IMPORT_ATTEMPTING_EMPTY_ZIP}}
> Because these two error messages are distinct and reliably mappable to file
> state, an attacker with {{ADMIN_IMPORT}} access can probe arbitrary paths and
> infer which files exist and are readable by the Atlas process.
> h3. Impact
> * Enumeration of readable filesystem paths on the Atlas server
> * Information disclosure about server layout, configuration files, and
> sensitive paths
> * Useful as reconnaissance for further attacks
> h3. Example Request
> {code:java}
> POST /api/atlas/admin/importfile
> Content-Type: application/json
> {
> "fileName": "/etc/passwd"
> }{code}
> h2. Issue 2: Arbitrary Path Read / Content Disclosure via ZIP Import
> h3. Description
> The endpoint accepts any absolute or relative server-local path in
> {{fileName}} and attempts to read and parse it as an Atlas export ZIP
> archive. There is no restriction to a configured import directory, no path
> canonicalization, and no allowlist of permitted locations.
> h3. Behavior
> When {{fileName}} points to a valid ZIP-structured file anywhere on the
> filesystem that the Atlas process can read:
> # The server opens the file directly using {{new File(fileName)}} and {{new
> FileInputStream(file)}}
> # The ZIP contents are parsed and processed as an Atlas import
> # Import results — including entity metrics and parsed contents — are
> returned in the {{AtlasImportResult}} response
> This means any readable ZIP file on the host (Atlas export archives, backups,
> or other ZIP artifacts) can be imported and its contents reflected in the API
> response, even if the file was never placed in an intended import location.
> h3. Impact
> * Read/import of ZIP files from arbitrary filesystem locations accessible to
> Atlas
> * Disclosure of metadata and entity contents from Atlas export archives
> stored outside the intended import directory
> * Potential exposure of sensitive backup or export data placed elsewhere on
> the server
> h3. Example Request
> {code:java}
> POST /api/atlas/admin/importfile
> Content-Type: application/json
> {
> "fileName": "/var/backups/atlas-export.zip"
> }{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
