Chinmay N Hegde created RANGER-5855:
---------------------------------------
Summary: KMS key ACL bypass via uppercase key name
Key: RANGER-5855
URL: https://issues.apache.org/jira/browse/RANGER-5855
Project: Ranger
Issue Type: Bug
Components: kms, Ranger
Affects Versions: 3.0.0
Reporter: Chinmay N Hegde
Assignee: Chinmay N Hegde
Ranger KMS stores encryption keys in a case-insensitive manner — all key names
are converted to lowercase internally before storing in DB. However, the
per-key ACL authorisation check is case-sensitive. An authenticated user can
bypass per-key ACLs by requesting the key name in a different case (e.g,
TESTKEY instead of testkey).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
