Authentication Bypass Vulnerability in InfluxDB: CVE-2019-20933
Summary
CVE-2019-20933: InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret). Affects influxdb across 2 version ranges.
< 1.6.7~rc0-1
< 761b557315ff9c1642cf3b0e5797cd3d983a24c0
Fixed in 1.6.7~rc0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
InfluxDB is an open-source time series database designed for high-performance data storage and retrieval. It is widely used for monitoring, analytics, and real-time data processing. The database supports various data types and provides powerful querying capabilities. However, prior to version 1.7.6, InfluxDB was susceptible to an authentication bypass vulnerability due to improper handling of JWT tokens, which could allow unauthorized access to the database.
Vulnerability Detail
CVE-2019-20933 is an authentication bypass vulnerability found in InfluxDB versions before 1.7.6. The issue arises in the authenticate function located in services/httpd/handler.go, where a JSON Web Token (JWT) may be accepted even if the SharedSecret is empty. This flaw can lead to unauthorized users gaining access to sensitive data and performing actions without proper authentication, posing significant security risks to the integrity and confidentiality of the database.
How To Fix
Minimum fixed version
1.6.7~rc0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade influxdbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider implementing additional security measures such as restricting access to the InfluxDB service through firewall rules or using a reverse proxy with authentication to limit exposure until a proper fix can be applied.
Conclusion
CVE-2019-20933 represents a significant security risk for users of InfluxDB versions prior to 1.7.6, allowing unauthorized access due to an authentication bypass. It is crucial to upgrade to the latest version to mitigate this vulnerability and protect sensitive data.
See every vulnerability recorded for influxdb →
FAQ
CVE-2019-20933 is an authentication bypass vulnerability in InfluxDB that allows unauthorized access due to improper handling of JWT tokens.
InfluxDB versions prior to 1.7.6 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score for CVE-2019-20933 is 9.8, indicating a critical level of severity.
If immediate upgrading is not possible, implement additional security measures such as firewall restrictions or using a reverse proxy with authentication.
References
Related vulnerabilities
Recent vulnerabilities recorded for influxdb.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
