Dremio Improper Authorization Vulnerability Allows Arbitrary File Deletion

A vulnerability allowing authenticated users to delete arbitrary files accessible to the system has been identified in Dremio. This issue arises from inadequate access controls on an API endpoint, enabling users to delete files beyond their authorized scope. The vulnerability affects system files as well as files stored in remote locations like S3 and Azure Blob Storage, and on local filesystems. Exploitation of this vulnerability could result in data loss, denial of service, and potentially escalate impacts depending on the files deleted.

Impact

Exploitation of this vulnerability could lead to unauthorized deletion of files, causing data loss and disruption of services. Additionally, depending on the nature of the deleted files, there could be further escalation of impact.

Remediation

Users are advised to upgrade to Dremio versions 24.3.17 and above, 25.0.15 and above, 25.1.8 and above, 25.2.5 and above, or 26.0.0 and above.