CVE-2022-26112: Apache Pinot Groovy Function Support Enabled by Default
Summary
CVE-2022-26112: Apache Pinot has Groovy Function support enabled by default. Affects org.apache.pinot:pinot versions < 0.11.0. Fixed in 0.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Pinot is an open-source distributed columnar data store that is designed to provide low-latency analytics with real-time data. It allows users to run functions using Apache Groovy scripts. Pinot versions prior to 0.10.0 have a vulnerability in unprotected environments where groovy function support is enabled by default. This vulnerability can be exploited to execute arbitrary code and potentially gain unauthorized access to the system.
Vulnerability Detail
The vulnerability in Apache Pinot arises from the default enabling of groovy function support in the Pinot query endpoint and realtime ingestion layer. In unprotected environments, this allows an attacker to execute arbitrary code through Apache Groovy scripts. The impact of this vulnerability can be severe, as it can lead to unauthorized access, data manipulation, and potential system compromise. The vulnerability has been assigned a CVSS score of 9.8 (Critical).
How To Fix
Minimum fixed version
0.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a potential workaround is to disable groovy script support manually. This can be done by modifying the Pinot configuration to turn off groovy function support. However, this workaround should be considered temporary, and upgrading to a fixed version is strongly recommended.
Conclusion
The vulnerability in Apache Pinot, where groovy function support is enabled by default, can lead to the execution of arbitrary code and potential system compromise. It is crucial to upgrade to Apache Pinot version 0.11.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.pinot:pinot →
FAQ
Apache Pinot is an open-source distributed columnar data store designed for low-latency analytics with real-time data.
The vulnerability allows an attacker to execute arbitrary code through Apache Groovy scripts, potentially leading to unauthorized access, data manipulation, and system compromise.
To fix this vulnerability, upgrade to Apache Pinot version 0.11.0 or later, where the function support is disabled by default.
A temporary workaround is to manually disable groovy script support by modifying the Pinot configuration. However, upgrading to a fixed version is strongly recommended.
You can find more information about this vulnerability in the Apache Pinot documentation and the associated CVE entry.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pinot:pinot.
