PT-2023-20156 · Datahub · Datahub

Artsploit + 5 · Publicado 2023-02-10 · Atualizado 2025-12-03 · CVE-2023-25559

Positive Technologies (AI Summary)

CVSS v3.1

8.2

Alta

Vetor base

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DataHub (affected versions not specified)

Description The issue concerns the Metadata service (GMS) in DataHub, where the X-DataHub-Actor HTTP header is used to infer the user on whose behalf the frontend is sending a request. The header's name is retrieved in a case-insensitive manner, which can be exploited by an attacker to smuggle an X-DataHub-Actor header with different casing. This can lead to an authorization bypass, allowing any user to impersonate the system user account and perform actions on its behalf.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Incorrect Authorization

Enumeração de Fraquezas

CWE-287

CWE-863

Identificadores relacionados

CVE-2023-25559

GHSA-QGP2-QR66-J8R8

Produtos afetados

Datahub

Referências · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25559.json · Exploit
• https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-25559 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-25559 · Aviso do Fabricante
• https://t.me/cveNotify/144675 · Publicação no Telegram