近日，Apache 官方公告了一个 Apache Ambari 的任意文件下载漏洞。Ambari 的鉴权模块存在设计缺陷，恶意用户可以绕过身份验证，通过构造文件名以进行目录遍历和下载文件。

此漏洞主要是由于在鉴权过滤器 org.apache.ambari.server.security.authorization.AmbariAuthorizationFilter 中使用了 “String requestURI = httpRequest.getRequestURI();“ 引起。

 @Overridepublic void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
    HttpServletRequest httpRequest = (HttpServletRequest) request;
    HttpServletResponse httpResponse = (HttpServletResponse) response;

    String requestURI = httpRequest.getRequestURI();

    SecurityContext context = getSecurityContext();

    Authentication authentication = context.getAuthentication();

    AuditEvent auditEvent = null;
    ....
}

当 Web 服务器处理像访问 “/everyone-has-permission-path/..;/admin-has-permission-path” 这样的路径时，将返回资源 “admin-has-permission-path”， 但是过滤器中的 “httpRequest.getRequestURI()” 将返回路径 “/everyone-has-permission-path/..;/admin-has-permission-path”，因此下面的代码将导致通过匹配的许可：

@Override
  public void doFilter(ServletRequest request, ServletResponse
response, FilterChain chain) throws IOException, ServletException {
    ...
    if (authentication == null || authentication instanceof
AnonymousAuthenticationToken) {
      ...
    }
    if (authentication == null || authentication instanceof
AnonymousAuthenticationToken ||
        !authentication.isAuthenticated()) {
      ...
    } else if (!authorizationPerformedInternally(requestURI)) {
      boolean authorized = false;

      if (requestURI.matches(API_BOOTSTRAP_PATTERN_ALL)) {
        authorized = AuthorizationHelper.isAuthorized(authentication,
            ResourceType.CLUSTER,
            null,
            EnumSet.of(RoleAuthorization.HOST_ADD_DELETE_HOSTS));
      }
      else {
        ...
      }
      ...
    }
    ...
  }

据悉，该漏洞会影响 Ambari 2.6.2.2 及更早版本，升级到更高版本可解决此问题。详细内容可以查看 Apache 公告。