Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2023-25560: Attackers can create accounts and bypass login in DataHub
CVE-2023-25560 · published 3 years ago
Summary
The account‑creation service in DataHub builds JSON messages using data supplied by users without proper checks. This allows a malicious user to alter the messages and gain unauthorized access, potentially creating privileged system accounts and taking full control of the platform. Upgrade to the latest version of DataHub as soon as possible; no temporary fixes are available.
What to do
- Update datahub datahub to version 0.8.45 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| datahub | datahub |
< 0.8.45 cpe:2.3:a:datahub:datahub:*:*:*:*:*:*:*:* |
Original advisory text
JSON Injection in DataHub
DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be able to augment these JSON strings to be sent to the backend and that can potentially be abused by including new or colliding values. This issue may lead to an authentication bypass and the creation of system accounts, which effectively can lead to full system compromise. Users are advised to upgrade. There are no known workarounds for this vulnerability. This vulnerability was discovered and reported by the GitHub Security lab and is tracked as GHSL-2022-080.
References
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-913Improper Control of Dynamically-Managed Code Resources
Timeline
Published10 Feb 2023
Updated4 Nov 2026
First seen12 Apr 2026
Track software like this
Free during beta