Rewterz Threat Advisory – Multiple Apache IoTDB Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-24830 CVSS:7.5

Apache IoTDB could allow a remote attacker to bypass security restrictions, caused by an improper authentication flaw in iotdb-web-workbench. By sending a specially-crafted request, an attacker could exploit this vulnerability to create an user without authorization.

CVE-2023-24829 CVSS:7.5

Apache IoTDB could allow a remote attacker to bypass security restrictions, caused by an incorrect authorization flaw in iotdb-web-workbench. By sending a specially-crafted request, an attacker could exploit this vulnerability to forge the JWTToken to access workbench.

Impact

Security Bypass

Indicators Of Compromise

CVE

CVE-2023-24830
CVE-2023-24829

Affected Vendors

Apache

Affected Products

Apache IoTDB 0.13.2
Apache IoTDB 0.13.1
Apache IoTDB 0.13.0

Remediation

Upgrade to the latest version of Apache IoTDB, available from the Apache Website.

Apache Website

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo