Server-side Request Forgery (SSRF)Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) through IMPORT DATABASE in ImportDatabaseStatement, SourceDiscovery, and the import source handlers. An authenticated SQL user can trigger the flaw by supplying an IMPORT DATABASE URL or path that points to a remote internal address or a local file, causing the server to fetch attacker-chosen content and import it as records. This lets the attacker reach internal services such as cloud metadata endpoints or read files like /etc/passwd from the server process. The result is exposure of internal network responses and local file contents to the user through the database import output.
Notes
IMPORT DATABASE is exposed over the SQL command/query endpoints, not the server administration API; the maintainer advisory says /api/v1/server was already root-only and unaffected.- Local-file imports are gated by the optional
arcadedb.server.security.importAllowedLocalPaths allow-list; when it is set, file:// and plain-path sources are restricted to the configured directories, while classpath:// resources remain permitted.
Workarounds
- Restrict SQL command/query access to trusted administrative users; do not grant
IMPORT DATABASE capability to untrusted accounts, which prevents authenticated non-admin users from triggering SSRF to internal endpoints or reading local files through the import path.
How to fix Server-side Request Forgery (SSRF)? Upgrade com.arcadedb:arcadedb-server to version 26.6.1 or higher.
| |
Missing AuthorizationAffected versions of this package are vulnerable to Missing Authorization through the time-series, batch, Prometheus, and Grafana HTTP handlers in AbstractServerHttpHandler-based routes such as PostBatchHandler, PostTimeSeriesWriteHandler, PostTimeSeriesQueryHandler, GetTimeSeriesLatestHandler, and the Grafana/PromQL handlers. An attacker can read or write a different database by sending requests with that database name in the path, even when their account is authorized only for another database. These handlers resolved the {database} path parameter and opened the database without enforcing canAccessToDatabase(), so a low-privilege user could reach another database’s time-series data, batch execution, and Prometheus/Grafana query endpoints. The impact is unauthorized cross-database access, including data disclosure and data modification, with the victim database’s contents and query results exposed to the attacker.
Workarounds
- Restrict access to the affected time-series, batch, Prometheus, and Grafana endpoints to only users authorized for the target database; do not allow accounts scoped to one database to call
/api/v1/batch/{db}, /api/v1/ts/{db}/write, /api/v1/ts/{db}/query, /api/v1/ts/{db}/prom/api/v1/query, or /api/v1/ts/{db}/grafana/health against other databases, as this blocks cross-database read/write access.
How to fix Missing Authorization? Upgrade com.arcadedb:arcadedb-server to version 26.7.2 or higher.
| |
Incorrect AuthorizationAffected versions of this package are vulnerable to Incorrect Authorization n the ServerSecurityUser.getDatabaseUser and ArcadeDBServer.createDatabase processes. An attacker can gain unauthorized access to read, write, and modify schema and data across databases by exploiting improper authorization checks and uninitialized security controls.
How to fix Incorrect Authorization? Upgrade com.arcadedb:arcadedb-server to version 26.4.2 or higher.
| |
