Apache Kyuubi Server Unauthorized File Access Vulnerability

A vulnerability in Apache Kyuubi Server in versions 1.6.0 through 1.10.2 allows clients to bypass the server-side configuration that restricts access to local files. This is achieved by exploiting Kyuubi frontend protocols to access files not listed in the allowed directory configuration. The absence of proper path normalization enables this unauthorized access.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files on the server, potentially allowing for the disclosure of sensitive information or manipulation of files in a way that could affect the application's behavior.

Remediation

Users are advised to upgrade to Apache Kyuubi version 1.10.3 or later, which addresses this vulnerability.