Executive brief
Apache Ranger is an access control framework used to manage security policies and data protection across Hadoop and other enterprise platforms. A server-side request forgery (SSRF) vulnerability in the Edit Service Page of its web UI allows unauthenticated attackers to force the Ranger server to make requests to internal systems or external destinations, potentially exposing sensitive data or facilitating lateral movement within the network. This could compromise the confidentiality and integrity of protected systems.
Technical details
This is an SSRF vulnerability (CWE-918) rooted in improper input validation (CWE-20) within the Edit Service Page component of Apache Ranger's UI. The vulnerability requires no authentication, no user interaction, and is remotely exploitable over the network (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). An attacker can craft a malicious request to the affected endpoint containing a URL parameter that the Ranger server will fetch server-side, potentially accessing internal services, metadata, or exfiltrating data. The patch is available in Apache Ranger version 2.5.0; users running versions 0.5.0 through 2.4.0 should upgrade immediately.
Affected products
- Apache Ranger 0.5.0 to 2.4.0
Timeline
- 2025-01-21: disclosed: Published to NVD
- 2025-01-22: disclosed: Published to GitHub Advisory Database
- 2025-01-22: patched: Patch available in Apache Ranger 2.5.0