PT-2023-20156 · Datahub · Datahub

Artsploit + 5 · Published 2023-02-10 · Updated 2025-12-03 · CVE-2023-25559

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions DataHub (affected versions not specified)

Description The issue concerns the Metadata service (GMS) in DataHub, where the X-DataHub-Actor HTTP header is used to infer the user on whose behalf the frontend is sending a request. The header's name is retrieved in a case-insensitive manner, which can be exploited by an attacker to smuggle an X-DataHub-Actor header with different casing. This can lead to an authorization bypass, allowing any user to impersonate the system user account and perform actions on its behalf.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Incorrect Authorization

Weakness Enumeration

CWE-287

CWE-863

Related Identifiers

CVE-2023-25559

GHSA-QGP2-QR66-J8R8

Affected Products

Datahub

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25559.json · Exploit
• https://github.com/datahub-project/datahub/security/advisories/GHSA-qgp2-qr66-j8r8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25559 · Security Note
• https://osv.dev/vulnerability/CVE-2023-25559 · Vendor Advisory
• https://t.me/cveNotify/144675 · Telegram Post