Summary
OpenSearch SQL plugin is a plugin that enables SQL and PPL query capabilities on OpenSearch clusters, including direct query integration with external data sources via Apache Spark. An issue exists where the Flint extension query handler validates SQL queries without sufficient restrictions, allowing a user with async query access to bypass the SQL grammar deny list via the direct query endpoint.
Impact
A remote authenticated user with async query access can run arbitrary code on Apache Spark workers by embedding prohibited SQL constructs within materialized view creation statements submitted to the direct query endpoint. This issue affects the OpenSearch SQL plugin in versions 2.13 through 3.6.
Patches
This issue has been addressed in OpenSearch SQL plugin versions 2.19.6, and 3.7.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Users who do not use the direct query feature (external data sources with Spark integration) are not affected. Users who have direct query configured should restrict async query access to trusted users only until the patch is applied.
Summary
OpenSearch SQL plugin is a plugin that enables SQL and PPL query capabilities on OpenSearch clusters, including direct query integration with external data sources via Apache Spark. An issue exists where the Flint extension query handler validates SQL queries without sufficient restrictions, allowing a user with async query access to bypass the SQL grammar deny list via the direct query endpoint.
Impact
A remote authenticated user with async query access can run arbitrary code on Apache Spark workers by embedding prohibited SQL constructs within materialized view creation statements submitted to the direct query endpoint. This issue affects the OpenSearch SQL plugin in versions 2.13 through 3.6.
Patches
This issue has been addressed in OpenSearch SQL plugin versions 2.19.6, and 3.7.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds
Users who do not use the direct query feature (external data sources with Spark integration) are not affected. Users who have direct query configured should restrict async query access to trusted users only until the patch is applied.