FileIO endpoint redirect leaks credentials in Apache Polaris
Apache Polaris before 1.8.0 lets an authenticated principal who can create or update Iceberg table properties store FileIO client settings, including s3.endpoint, in table metadata. When the catalog storage configuration does not override the endpoint, server-side Iceberg operations such as commits and purges may build the server FileIO client from those settings and send storage requests to a host chosen by the table writer. Those requests use credentials scoped to the operation, so authentication material can be exposed to the chosen endpoint and server-side storage traffic can be redirected. Deployments are affected when table writers are not trusted to configure server-side storage endpoints. No public proof of concept is known, the issue is not in CISA KEV, and CVSS has not yet been scored.
What to do: Upgrade Apache Polaris to 1.8.0 or later. Until then, make catalog storage configuration override FileIO endpoints so table metadata cannot steer server-side clients, and do not grant create or update of table properties to principals who should not control storage endpoints. Review existing table metadata for unexpected FileIO settings such as s3.endpoint.
| Product | Affected |
|---|---|
| Apache Polaris | < 1.8.0 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Apache Polaris allows an authenticated principal with permission to create or update Iceberg table properties to set FileIO client settings such as s3.endpoint in table metadata. In versions < 1.8.0, when Polaris performs server-side Iceberg operations, including commits and purges, it may use those settings to construct its (server-side) FileIO client. If the catalog storage configuration does not override the endpoint, Polaris can send storage requests to a host chosen by the table writer, using credentials scoped to the operation. This can redirect server-side storage traffic and expose request authentication material to the chosen endpoint. Deployments are affected when table writers are not trusted to configure server-side storage endpoints.
Apache Polaris before 1.8.0 lets authorized Iceberg table writers set FileIO endpoints in metadata, redirecting server-side requests to attacker-controlled servers.
Today 1.6K readers · 2.5K views · 779 reads · all time 189K views