Executive brief
Cube.js is an open-source analytics platform that provides an API gateway for querying data. In production deployments, the default Express middleware authentication check is bypassed, allowing unauthenticated access to the API gateway. This could expose sensitive analytics data and allow unauthorized users to query or manipulate data without proper authorization.
Technical details
The vulnerability exists in @cubejs-backend/api-gateway versions 0.11.0 through 0.11.16, where the default Express authentication middleware is not properly enforced in production environments. This is an authentication bypass vulnerability affecting the API gateway's security middleware. The root cause appears to be conditional logic that incorrectly disables or skips the checkAuthMiddleware function when running in production mode. An attacker on the network can make unauthenticated requests to the API gateway endpoints without credentials, gaining unauthorized access to analytics data and potentially manipulating queries. The vulnerability requires network-level access to the Cube.js deployment. A patch is available in version 0.11.17, and users can immediately mitigate by manually overriding the default authentication express middleware configuration.
Affected products
- Cube.js @cubejs-backend/api-gateway 0.11.0 through 0.11.16
Timeline
- 2019-11-08: disclosed
- 2019-11-08: patched: Fixed in version 0.11.17