Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Apache Polaris allows for unauthorized access to data by exploiting how special characters are handled. When creating temporary access policies for tables, Polaris incorrectly uses wildcards, enabling crafted table requests to access unrelated data. This could expose sensitive metadata or allow unauthorized modifications to data.
- Compromised credentials can access other tables.
- Sensitive table metadata may be disclosed.
- Unauthorized data modifications are possible.
Attack Path
How an attacker could exploit the issue
An attacker could exploit this by creating a specially crafted table name with wildcard characters in Apache Polaris. This allows them to obtain temporary S3 credentials that, due to improper escaping of the wildcard characters in S3 IAM policies, grant them access to other tables' data and metadata. The attacker could then read, list, or even modify data belonging to different tables without proper authorization.
- Attacker needs table creation permission.
- Exploits unescaped wildcard characters.
- Allows cross-table data access.
Live Threat
Current exploitation, exposure, and threat context
Attackers may find this vulnerability appealing because it allows for unauthorized access to sensitive data and potentially unauthorized modifications to cloud storage. The ability to bypass access controls and reach other tables' S3 locations, even with minimal initial permissions, presents a significant risk. This could lead to data exfiltration or manipulation within the cloud environment.
- Limited observed exploitation.
- No public exploit code confirmed.
- Exploitability depends on deployment context.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize reviewing logs for unexpected S3 access patterns, especially those involving wildcard characters in table or namespace names. Block any traffic exhibiting this behavior and immediately inventory all affected tables and their associated S3 storage to assess exposure.
- Isolate affected services if exploitation is confirmed.
- Upgrade Apache Polaris to version 1.4.1 or later.
- Monitor S3 access logs for unauthorized activity.
