rdblue opened a new issue, #16463: URL: https://github.com/apache/iceberg/issues/16463
> This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution. > > Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them. # Summary The ADLS credential refresh endpoint accepts arbitrary absolute URLs and reuses the catalog auth session when calling them, enabling cross-origin credential leakage. # Affected Maven coordinates * primary shipped client artifact: `org.apache.iceberg:iceberg-azure` * bundle artifact: `org.apache.iceberg:iceberg-azure-bundle` # Attacker prerequisites * control over the affected catalog response, configuration surface, or spec-consumed routing value * a client or service that honors the affected configuration without an additional allow-list # Impact * If `adls.refresh-credentials-endpoint` is pointed at another origin, Iceberg will send the catalog-authenticated request there. * That can leak catalog auth headers or bearer tokens to an attacker-controlled endpoint. * Plaintext `http://` is accepted too, so the same flow can be downgraded to cleartext transport. # Proof status Source review only. The issue is visible directly from source. # Key source references * org.apache.iceberg.azure.AzureProperties * org.apache.iceberg.azure.adlsv2.VendedAdlsCredentialProvider * org.apache.iceberg.rest.RESTUtil * org.apache.iceberg.rest.HTTPRequest Current severity assessment [2]: Important [1] https://iceberg.apache.org/security/ [2] https://security.apache.org/blog/severityrating/ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
