CVE-2024-23768 : Security Advisory and Response

This article provides detailed information about CVE-2024-23768, covering its impact, technical details, and mitigation strategies.

Understanding CVE-2024-23768

CVE-2024-23768 is a security vulnerability found in Dremio versions before 24.3.1, allowing path traversal. An authenticated user with no privileges on specific folders can gain unauthorized access to these folders, files, and datasets. The issue affects versions 24.0.0 through 24.3.0, 23.0.0 through 23.2.3, and 22.0.0 through 22.2.2.

What is CVE-2024-23768?

The CVE-2024-23768 vulnerability in Dremio enables authenticated users to access folders, files, and datasets they are not authorized to view. This security flaw can lead to unauthorized data access and potential data breaches.

The Impact of CVE-2024-23768

The impact of CVE-2024-23768 is rated as high severity according to the CVSS v3.1 base score of 8.8. The confidentiality, integrity, and availability of affected systems are at risk due to the unauthorized access allowed by this vulnerability.

Technical Details of CVE-2024-23768

The technical details of CVE-2024-23768 provide insights into the vulnerability, affected systems, and exploitation mechanism.

Vulnerability Description

The vulnerability in Dremio before version 24.3.1 allows authenticated users to conduct path traversal attacks, gaining access to unauthorized folders, files, and datasets within the system.

Affected Systems and Versions

CVE-2024-23768 impacts Dremio versions 24.0.0 through 24.3.0, 23.0.0 through 23.2.3, and 22.0.0 through 22.2.2. Users of these versions are susceptible to unauthorized access risks.

Exploitation Mechanism

The vulnerability requires an authenticated user with no privileges on specific folders to exploit path traversal and access unauthorized data. Access to the source and at least one folder within the source is necessary for successful exploitation.

Mitigation and Prevention

To address CVE-2024-23768 and enhance the security of systems running Dremio, immediate steps should be taken, followed by long-term security practices and regular patching.

Immediate Steps to Take

Implement access controls to restrict user privileges, ensuring that only authorized users can access sensitive folders, files, and datasets. Upgrade to the fixed versions provided by Dremio (24.3.1 and later, 23.2.4 and later, and 22.2.3 and later).

Long-Term Security Practices

Regularly review and update access permissions, conduct security audits, and train users on secure data handling practices to prevent similar vulnerabilities in the future.

Patching and Updates

Stay informed about security updates released by Dremio and promptly apply patches to ensure that systems are protected against known vulnerabilities, including CVE-2024-23768.