Horizon Alert
Summary of the vulnerability and why it matters
An issue in Apache Polaris allows a user with existing access to alter table settings to cause the system to write metadata to an attacker-controlled storage location. This can lead to the system later issuing credentials that grant access to that location, potentially exposing or corrupting data and metadata.
- Can expose or modify data.
- Affects systems with specific configuration.
- Requires existing table modification privileges.
Attack Path
How an attacker could exploit the issue
An attacker with existing read access to a table in an Apache Polaris catalog could abuse a flaw in how table metadata paths are updated. By changing the `write.metadata.path` table property, they can trick Polaris into writing new table metadata to an attacker-chosen location before proper validation occurs. This allows them to potentially expose or corrupt data and metadata within that location, and later gain credentials to access it.
- Requires authenticated user access.
- Target: Apache Polaris catalog settings.
- Precondition: Specific catalog configuration.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability presents a significant risk in configurations allowing unstructured table locations, enabling an authenticated user to redirect metadata writes and potentially compromise or corrupt data and metadata accessible by Polaris. The core issue stems from bypassing commit-time validation, leading to subsequent credential vending for attacker-chosen storage locations.
- Exploitation requires authenticated access.
- Targeted configuration is specific.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize isolating services using Apache Polaris if they allow unauthenticated users to alter table settings or if the `polaris.config.allow.unstructured.table.location` property is enabled. This vulnerability can allow an attacker to write metadata to arbitrary locations, potentially leading to data exposure or corruption, and could even lead to credential vending for cloud storage.
- Block unauthorized table setting changes.
- Monitor for suspicious metadata writes.
- Update to Polaris version 1.4.1 or later.
