Mandar Ambawane created ATLAS-5421:
--------------------------------------
Summary: Arbitrary file existence oracle and arbitrary path read
via POST /api/atlas/admin/importfile
Key: ATLAS-5421
URL: https://issues.apache.org/jira/browse/ATLAS-5421
Project: Atlas
Issue Type: Improvement
Components: atlas-core
Reporter: Mandar Ambawane
Assignee: Mandar Ambawane
h3. Description
The endpoint returns distinguishable error responses depending on whether the
supplied path exists on the server, allowing an attacker to enumerate readable
files on the Atlas host.
h3. Behavior
When {{POST /api/atlas/admin/importfile}} is called with a JSON body containing
{{{}fileName{}}}:
* Non-existent path: Returns an error such as:
** {{invalid parameters: <path>: file not found}}
** Thrown from {{ImportService.java}} on {{FileNotFoundException}}
* Existing path that is not a valid ZIP archive (e.g. {{{}/etc/passwd{}}}):
Returns a different error such as:
** {{Attempting to import empty ZIP file.}}
** Thrown from {{ZipSourceWithBackingDirectory.java}} /
{{AtlasErrorCode.IMPORT_ATTEMPTING_EMPTY_ZIP}}
Because these two error messages are distinct and reliably mappable to file
state, an attacker with {{ADMIN_IMPORT}} access can probe arbitrary paths and
infer which files exist and are readable by the Atlas process.
h3. Impact
* Enumeration of readable filesystem paths on the Atlas server
* Information disclosure about server layout, configuration files, and
sensitive paths
* Useful as reconnaissance for further attacks
h3. Example Request
{code:java}
POST /api/atlas/admin/importfile
Content-Type: application/json
{
"fileName": "/etc/passwd"
}{code}
h2. Issue 2: Arbitrary Path Read / Content Disclosure via ZIP Import
h3. Description
The endpoint accepts any absolute or relative server-local path in {{fileName}}
and attempts to read and parse it as an Atlas export ZIP archive. There is no
restriction to a configured import directory, no path canonicalization, and no
allowlist of permitted locations.
h3. Behavior
When {{fileName}} points to a valid ZIP-structured file anywhere on the
filesystem that the Atlas process can read:
# The server opens the file directly using {{new File(fileName)}} and {{new
FileInputStream(file)}}
# The ZIP contents are parsed and processed as an Atlas import
# Import results — including entity metrics and parsed contents — are returned
in the {{AtlasImportResult}} response
This means any readable ZIP file on the host (Atlas export archives, backups,
or other ZIP artifacts) can be imported and its contents reflected in the API
response, even if the file was never placed in an intended import location.
h3. Impact
* Read/import of ZIP files from arbitrary filesystem locations accessible to
Atlas
* Disclosure of metadata and entity contents from Atlas export archives stored
outside the intended import directory
* Potential exposure of sensitive backup or export data placed elsewhere on
the server
h3. Example Request
{code:java}
POST /api/atlas/admin/importfile
Content-Type: application/json
{
"fileName": "/var/backups/atlas-export.zip"
}{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
