Listen to this Post
The CVE-2025-XXXXX vulnerability in lakeFS stems from a missing authentication check on a specific API endpoint. The `/api/v1/usage-report/summary` endpoint, designed to report aggregate API usage metrics, does not verify the identity or permissions of the requesting user. This design flaw allows any unauthenticated actor with network access to the lakeFS server to send HTTP GET requests to this endpoint. The server will respond with JSON data containing summarized counts of API events, such as the number of uploads or commits, over a configured time period. While the data is aggregated and does not contain sensitive user information or repository contents, it can reveal patterns of system activity, service uptime, and operational metrics. This information could be leveraged by an attacker for reconnaissance purposes to understand system usage before launching other attacks, or to infer the general health and activity level of the deployment.
Platform: lakeFS
Version: < v1.70.1
Vulnerability : Unauthenticated Access
Severity: Moderate
date: 2025-11-02
Prediction: Patched 2025-11-03
What Undercode Say:
curl -X GET http://lakefs-instance:8000/api/v1/usage-report/summary
{
"upload_count": 150,
"commit_count": 45,
"merge_count": 12
}
How Exploit:
An attacker sends an unauthenticated HTTP request to the vulnerable `/api/v1/usage-report/summary` endpoint. No credentials, API keys, or tokens are required. The server responds with aggregate usage statistics, which the attacker can collect.
Protection from this CVE
Upgrade lakeFS to version 1.70.1 or later. Alternatively, disable the usage reporting feature entirely by setting the configuration value `usage_report.enabled` or the environment variable `LAKEFS_USAGE_REPORT_ENABLED` to false.
Impact:
Unauthenticated information disclosure of system metrics. Reveals service activity levels and potential uptime, which can be used for reconnaissance. No direct compromise of sensitive data occurs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
