Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-45106

CVE-2024-45106:
Apache Ozone: Improper authentication when generating S3 secrets

8.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-45106
GHSA ID
GHSA-rcq8-9q3j-98mw
EPSS Score
0.50514%
CWE
CWE-287
Published
12/3/2024
Updated
12/3/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.ozone:ozonemaven= 1.4.01.4.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the S3SecretManagementEndpoint class added in PR #5233, which introduced REST endpoints for S3 secret management. The functions handle() sensitive operations but lacked proper authorization validation(). The CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization) mappings confirm the authentication/authorization flaws. The patch in 1.4.1 disables the endpoint entirely, indicating these functions were the vulnerability source. The HTTP method annotations (@PUT/@DELETE) and path parameters shown in code diffs align with the described attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Improp*r *ut**nti**tion o* *n *TTP *n*point in t** S* **t*w*y o* *p**** Ozon* *.*.* *llows *ny *ut**nti**t** K*r**ros us*r to r*vok* *n* r***n*r*t* t** S* s**r*ts o* *ny ot**r us*r. T*is is only possi*l* i*: * ozon*.s**.s**r*t.*ttp.*n**l** is s*t

Reasoning

T** vuln*r**ility st*ms *rom t** `S*S**r*tM*n***m*nt*n*point` *l*ss ***** in PR #****, w*i** intro*u*** R*ST *n*points *or S* s**r*t m*n***m*nt. T** *un*tions `**n*l*()` s*nsitiv* op*r*tions *ut l**k** prop*r *ut*oriz*tion `v*li**tion()`. T** *W*-***