Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Apache Polaris allows an attacker to craft table names to bypass access controls. When Polaris generates temporary credentials for accessing Google Cloud Storage, a specially crafted identifier can cause these credentials to grant broader access than intended, potentially allowing access to data outside the specific table. This is a significant concern because it can effectively remove path restrictions for credentials within the configured bucket.
- Credentials for one table can access others.
- This bypasses intended data separation.
- It could expose sensitive data broadly.
Attack Path
How an attacker could exploit the issue
An attacker with read access to the Apache Polaris catalog can craft a malicious namespace or table name to bypass the intended GCS credential scope. This allows them to obtain credentials that grant broader access, potentially to any data within the configured GCS bucket, not just the files of a specific table.
- Requires authenticated access.
- Exploits crafted table names.
- Allows broad GCS bucket access.
Live Threat
Current exploitation, exposure, and threat context
Attackers are unlikely to weaponize this CVE as it targets Apache Polaris, an internal data catalog service, not an internet-facing application. Exploitation requires an attacker to already possess authenticated access and specific table management privileges, limiting its appeal for broad attacks.
- Internal-only exposure.
- Requires prior authentication.
- Limited scope for opportunistic attacks.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Apache Polaris to version 1.4.1 or later immediately, as this critical vulnerability allows an attacker with table management privileges to bypass access controls and gain broad access to your Google Cloud Storage bucket. If patching is delayed, isolate affected services and implement strict monitoring for unusual GCS activity.
- Patch Apache Polaris to 1.4.1.
- Isolate affected Polaris instances.
- Monitor GCS for unauthorized access.
