liyang created KYLIN-6118:
-----------------------------
Summary: Potential unauthorized internal job-report RPC issue
Key: KYLIN-6118
URL: https://issues.apache.org/jira/browse/KYLIN-6118
Project: Kylin
Issue Type: Bug
Reporter: liyang
Several internal job progress-report RPC operations are exposed on the public
API port and are marked as public in the security chain, but they do not verify
the caller identity or authorization. A caller that knows a running job
identifier and its running-start value can submit forged progress, error,
stage-status, and wait/run-time updates to job metadata.
The affected operations are the internal job progress-report RPC endpoints
under the job controller.
Fix direction: require either an authenticated global administrator or a valid
internal service credential on these internal RPC operations, and have the
internal job-progress reporter send the credential.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
