[jira] [Commented] (ATLAS-5421) Prevent /api/atlas/admin/importfile from reading arbitrary server files and enumerating filesystem paths

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ATLAS-5421?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120120#comment-18120120 ] 

ASF subversion and git services commented on ATLAS-5421:
--------------------------------------------------------

Commit b829994b1c2443db8b5c5cc8dd6a8a65c49c1797 in atlas's branch refs/heads/ATLAS-5421-0928 from Mandar Ambawane
[ https://gitbox.apache.org/repos/asf?p=atlas.git;h=b829994b1 ]

ATLAS-5421 : Prevent /api/atlas/admin/importfile from reading arbitrary server files and enumerating filesystem paths


> Prevent /api/atlas/admin/importfile from reading arbitrary server files and enumerating filesystem paths
> --------------------------------------------------------------------------------------------------------
>
>                 Key: ATLAS-5421
>                 URL: https://issues.apache.org/jira/browse/ATLAS-5421
>             Project: Atlas
>          Issue Type: Improvement
>          Components:  atlas-core
>            Reporter: Mandar Ambawane
>            Assignee: Mandar Ambawane
>            Priority: Major
>
> h2. Issue 1: File Existence
> h3. Description
> The endpoint returns distinguishable error responses depending on whether the supplied path exists on the server, allowing an attacker to enumerate readable files on the Atlas host.
> h3. Behavior
> When {{POST /api/atlas/admin/importfile}} is called with a JSON body containing {{{}fileName{}}}:
>  * Non-existent path: Returns an error such as:
>  * 
>  ** {{invalid parameters: <path>: file not found}}
>  ** Thrown from {{ImportService.java}} on {{FileNotFoundException}}
>  * Existing path that is not a valid ZIP archive (e.g. {{{}/etc/passwd{}}}): Returns a different error such as:
>  * 
>  ** {{Attempting to import empty ZIP file.}}
>  ** Thrown from {{ZipSourceWithBackingDirectory.java}} / {{AtlasErrorCode.IMPORT_ATTEMPTING_EMPTY_ZIP}}
> Because these two error messages are distinct and reliably mappable to file state, an attacker with {{ADMIN_IMPORT}} access can probe arbitrary paths and infer which files exist and are readable by the Atlas process.
> h3. Impact
>  * Enumeration of readable filesystem paths on the Atlas server
>  * Information disclosure about server layout, configuration files, and sensitive paths
>  * Useful as reconnaissance for further attacks
> h3. Example Request
> {code:java}
> POST /api/atlas/admin/importfile 
> Content-Type: application/json 
> {
>  "fileName": "/etc/passwd" 
> }{code}
> h2. Issue 2: Arbitrary Path Read / Content Disclosure via ZIP Import
> h3. Description
> The endpoint accepts any absolute or relative server-local path in {{fileName}} and attempts to read and parse it as an Atlas export ZIP archive. There is no restriction to a configured import directory, no path canonicalization, and no allowlist of permitted locations.
> h3. Behavior
> When {{fileName}} points to a valid ZIP-structured file anywhere on the filesystem that the Atlas process can read:
>  # The server opens the file directly using {{new File(fileName)}} and {{new FileInputStream(file)}}
>  # The ZIP contents are parsed and processed as an Atlas import
>  # Import results — including entity metrics and parsed contents — are returned in the {{AtlasImportResult}} response
> This means any readable ZIP file on the host (Atlas export archives, backups, or other ZIP artifacts) can be imported and its contents reflected in the API response, even if the file was never placed in an intended import location.
> h3. Impact
>  * Read/import of ZIP files from arbitrary filesystem locations accessible to Atlas
>  * Disclosure of metadata and entity contents from Atlas export archives stored outside the intended import directory
>  * Potential exposure of sensitive backup or export data placed elsewhere on the server
> h3. Example Request
> {code:java}
> POST /api/atlas/admin/importfile 
> Content-Type: application/json 
> {
>  "fileName": "/var/backups/atlas-export.zip" 
> }{code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)