PT-2022-24933 · Datahub · Datahub

Artsploit + 6 · Published 2022-10-28 · Updated 2025-12-03 · CVE-2022-39366

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions DataHub versions prior to 0.8.45

Description The StatelessTokenService of the DataHub metadata service does not verify the signature of JWT tokens, allowing an attacker to connect to DataHub instances as any user if Metadata Service authentication is enabled. This occurs because the StatelessTokenService uses the parse method of io.jsonwebtoken.JwtParser, which does not perform a verification of the cryptographic token signature, accepting JWTs regardless of the used algorithm. This issue may lead to an authentication bypass.

Recommendations For versions prior to 0.8.45, update to version 0.8.45 to resolve the issue. As a temporary workaround, consider disabling the StatelessTokenService function until a patch is available. Restrict access to the Metadata service to minimize the risk of exploitation. Avoid using JWT tokens in the affected DataHub instances until the issue is resolved.

Exploit

Fix

Improper Authentication

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-287

CWE-347

CWE-303

Related Identifiers

CVE-2022-39366

GHSA-R8GM-V65F-C973

Affected Products

Datahub

References · 11

• 🔥 https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L30 · Exploit
• 🔥 https://github.com/datahub-project/datahub/blob/aa146db611e3a4ca3aa17bb740783f789d4444d3/metadata-service/auth-impl/src/main/java/com/datahub/authentication/token/StatelessTokenService.java#L134 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39366.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-39366 · Security Note
• https://osv.dev/vulnerability/GHSA-r8gm-v65f-c973 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-39366 · Vendor Advisory
• https://github.com/datahub-project/datahub · Note
• https://github.com/datahub-project/datahub/security/advisories/GHSA-r8gm-v65f-c973 · Note
• https://github.com/datahub-project/datahub/releases/tag/v0.8.45 · Note
• https://codeql.github.com/codeql-query-help/java/java-missing-jwt-signature-check · Note
• https://t.me/cveNotify/144673 · Telegram Post