Vulnerabilidade de Validação de Entrada Incorreta em Apache Hop Engine

The vulnerability lies in how the Hop Server component constructs links to the PrepareExecutionPipelineServlet. Specifically, the 'id' parameter, which identifies a pipeline, is not properly escaped before being included in the URL. While users typically don't directly create pipelines, an attacker could potentially craft a malicious URL that, when accessed, could lead to unintended consequences. Although the description indicates a low risk due to the indirect accessibility of the 'id' parameter, successful exploitation could lead to unauthorized access or modification of pipeline configurations within the Hop Server environment. The blast radius is limited to the Hop Server component itself, and does not directly affect the client.

Organizations utilizing Apache Hop Engine for data integration and transformation workflows, particularly those running versions prior to 2.8.0, are at risk. Environments where the Hop Server component is exposed to external networks or untrusted users are especially vulnerable.

• linux / server: Monitor Hop Server logs for unusual activity related to the PrepareExecutionPipelineServlet. Use journalctl -u hop-server to filter for errors or suspicious requests containing the 'id' parameter. • generic web: Use curl to test the PrepareExecutionPipelineServlet URL with various 'id' parameters containing special characters. Examine the response for any signs of unexpected behavior or error messages.

curl 'http://<hop-server>/hop-server/PrepareExecutionPipelineServlet?id=<malicious_id>' -v

1. 2024-03-19Disclosure

   disclosure

1. Reservado2024-01-26
2. Publicada2024-03-19
3. Modificada2024-11-22
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-24683 is to upgrade to Apache Hop Engine version 2.8.0, which includes the necessary fix for the improper input validation. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'id' parameter of the PrepareExecutionPipelineServlet URL. Additionally, carefully review and restrict access to the Hop Server component to limit the potential attack surface. After upgrade, confirm the fix by attempting to access a pipeline URL with a specially crafted 'id' parameter containing potentially malicious characters; the URL should be properly escaped and not lead to any unexpected behavior.