Critical SSRF Vulnerability in Apache Ranger UI (Version 2.4.0)
Summary
CVE-2024-45479: Apache Ranger UI vulnerable to Server Side Request Forgery. Affects org.apache.ranger:ranger versions < 2.5.0. Fixed in 2.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Ranger is a framework to enable, monitor, and manage comprehensive data security across the Hadoop platform. It provides a centralized security administration and fine-grained access control for Hadoop data. The vulnerability in question affects the Apache Ranger UI, specifically in the Edit Service Page, which allows users to configure services and manage security policies. This vulnerability exposes the system to potential Server Side Request Forgery (SSRF) attacks, which can lead to unauthorized access to internal resources.
Vulnerability Detail
The SSRF vulnerability in Apache Ranger UI arises from improper validation of user input in the Edit Service Page. This flaw allows an attacker to craft requests that can be sent to internal services, potentially exposing sensitive data or allowing unauthorized actions. The critical nature of this vulnerability is underscored by its CVSS score of 9.1, indicating a high risk of exploitation that could lead to severe consequences for affected systems.
How To Fix
Minimum fixed version
2.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the Edit Service Page for untrusted users or implement network-level controls to limit the ability of the application to make outbound requests to internal services until the upgrade can be performed.
Conclusion
The SSRF vulnerability in Apache Ranger UI poses a significant risk to users of version 2.4.0. It is crucial to upgrade to version 2.5.0 to mitigate this risk. Users should also consider implementing temporary workarounds and monitoring their applications for any signs of exploitation.
See every vulnerability recorded for org.apache.ranger:ranger →
FAQ
Server Side Request Forgery (SSRF) is a vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to data exposure or unauthorized actions.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can also use the Vulert playground to analyze your pom.xml without any signup.
The risks include unauthorized access to internal services, potential data leakage, and the ability for attackers to manipulate internal resources, leading to further exploitation.
It is not safe to continue using version 2.4.0 due to the critical SSRF vulnerability. Immediate action should be taken to upgrade to version 2.5.0 or later.
If an immediate upgrade is not possible, implement network-level controls to restrict access to the Edit Service Page and monitor for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.ranger:ranger.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
