CVE-2020-15087: Privilege escalation in Presto
Summary
CVE-2020-15087: Privilege escalation in Presto. Affects io.prestosql:presto-server versions < 337. Fixed in 337. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Presto is an open-source distributed SQL query engine designed for running interactive analytic queries against various data sources. It allows users to query large datasets across multiple databases and file systems. The Presto server is responsible for processing and executing these queries. However, a vulnerability has been discovered in Presto server installations that allows authenticated users to bypass authorization checks by directly accessing internal APIs. This vulnerability specifically affects installations with secure internal communication configured.
Vulnerability Detail
The vulnerability in Presto server installations allows authenticated users to bypass authorization checks by directly accessing internal APIs. This can be exploited by attackers to gain unauthorized privileges and access sensitive information. It is important to note that this vulnerability only affects installations with secure internal communication configured. Installations that have not configured secure internal communication are inherently insecure and not impacted by this vulnerability.
How To Fix
Minimum fixed version
337
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
A temporary workaround for this vulnerability is to block network access to internal APIs on the coordinator and workers. By restricting access to these APIs, the risk of unauthorized privilege escalation can be mitigated. However, implementing this workaround may impact the functionality of certain features or applications that rely on these internal APIs.
Conclusion
In conclusion, the vulnerability in Presto server installations allows authenticated users to bypass authorization checks and gain unauthorized privileges. To mitigate this vulnerability, it is recommended to update PrestoSQL to version 337 or later. Additionally, blocking network access to internal APIs on the coordinator and workers can serve as a temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for io.prestosql:presto-server →
FAQ
This vulnerability affects Presto server installations with secure internal communication configured. Installations that have not configured secure internal communication are not impacted.
The impact of this vulnerability is that authenticated users can bypass authorization checks and gain unauthorized privileges. This can lead to unauthorized access to sensitive information and potential misuse of the affected Presto server installation.
To fix this vulnerability, it is recommended to update PrestoSQL to version 337 or later. This update includes the necessary fixes to address the privilege escalation issue.
Yes, a temporary workaround is to block network access to internal APIs on the coordinator and workers. This can help mitigate the risk of unauthorized privilege escalation. However, implementing this workaround may impact certain features or applications that rely on these internal APIs.
For more information, you can refer to the Presto documentation on Secure Internal Communication. Additionally, you can join the #security channel on Slack or contact the security team at security@trino.io.
