[
https://issues.apache.org/jira/browse/KYLIN-6118?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18123746#comment-18123746
]
ASF subversion and git services commented on KYLIN-6118:
--------------------------------------------------------
Commit 43e1890d5723ba779b7d4cbb6d97a5d723e27e5e in kylin's branch
refs/heads/kylin5 from Li Yang
[ https://gitbox.apache.org/repos/asf?p=kylin.git;h=43e1890d57 ]
KYLIN-6118 require service token on internal job-report RPC endpoints
The job progress-report RPC handlers (error, stage status, spark, and
wait/run time) are exposed on the public API port and were listed as
public in the security chain without any authorization check. Only an
optimistic job-status check protected them, so a caller that knows a
running job identifier and start time could forge job progress metadata.
Require a global admin or a valid internal service credential on all four
handlers, and have the Spark driver progress reporter send the
deployment-scoped credential, matching the broadcast and cache RPC fixes.
> Potential unauthorized internal job-report RPC issue
> ----------------------------------------------------
>
> Key: KYLIN-6118
> URL: https://issues.apache.org/jira/browse/KYLIN-6118
> Project: Kylin
> Issue Type: Bug
> Reporter: liyang
> Priority: Major
>
> Several internal job progress-report RPC operations are exposed on the public
> API port and are marked as public in the security chain, but they do not
> verify the caller identity or authorization. A caller that knows a running
> job identifier and its running-start value can submit forged progress, error,
> stage-status, and wait/run-time updates to job metadata.
> The affected operations are the internal job progress-report RPC endpoints
> under the job controller.
> Fix direction: require either an authenticated global administrator or a
> valid internal service credential on these internal RPC operations, and have
> the internal job-progress reporter send the credential.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
