CVE-2023-48796: Apache DolphinScheduler Info Disclosure

CVE-2023-48796 Overview

CVE-2023-48796 is an Exposure of Sensitive Information to an Unauthorized Actor vulnerability affecting Apache DolphinScheduler, a distributed and extensible workflow scheduler platform. This vulnerability allows unauthorized actors to access sensitive information, including database credentials, through improperly exposed management endpoints.

The vulnerability stems from overly permissive default configuration of Spring Boot Actuator endpoints in DolphinScheduler. When these endpoints are exposed without proper restrictions, attackers can access sensitive operational data and configuration details that should remain confidential.

Critical Impact

Unauthorized actors may gain access to sensitive data including database credentials, potentially leading to complete database compromise and further lateral movement within the affected infrastructure.

Affected Products

• Apache DolphinScheduler versions 3.0.0 to 3.0.1
• Apache DolphinScheduler deployments with default management endpoint configurations
• Environments where Spring Boot Actuator endpoints are exposed to untrusted networks

Discovery Timeline

• November 24, 2023 - CVE-2023-48796 published to NVD
• November 28, 2025 - Last updated in NVD database

Technical Details for CVE-2023-48796

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue arises from Apache DolphinScheduler's default configuration which exposes Spring Boot Actuator management endpoints to network access without proper authentication or authorization controls.

Spring Boot Actuator provides built-in endpoints for monitoring and managing applications. When these endpoints are exposed without restriction, they can reveal sensitive operational information including environment variables, configuration properties, and in this case, database credentials. The network-accessible nature of this vulnerability means that any attacker who can reach the DolphinScheduler service over the network can potentially extract sensitive information without requiring any privileges or user interaction.

Root Cause

The root cause of this vulnerability is the default web exposure configuration for management endpoints in Apache DolphinScheduler versions 3.0.0 through 3.0.1. By default, the management.endpoints.web.exposure.include setting is too permissive, allowing access to endpoints that expose sensitive configuration data, including database connection strings and credentials stored in environment variables or application properties.

Attack Vector

The attack vector for CVE-2023-48796 is network-based, requiring no authentication or user interaction. An attacker with network access to the DolphinScheduler instance can directly query the exposed management endpoints to retrieve sensitive information.

The exploitation process involves:

1. Identifying an exposed DolphinScheduler instance accessible over the network
2. Enumerating available Actuator endpoints (commonly /actuator, /actuator/env, /actuator/configprops)
3. Querying sensitive endpoints to extract database credentials and other configuration data
4. Using the obtained credentials to access backend databases or pivot to other systems

The vulnerability is particularly dangerous because it requires no special tools or complex exploitation techniques—standard HTTP requests to the exposed endpoints are sufficient to retrieve sensitive data.

Detection Methods for CVE-2023-48796

Indicators of Compromise

• Unexpected HTTP requests to /actuator/* endpoints from external or unauthorized IP addresses
• Access log entries showing enumeration of Actuator endpoints such as /actuator/env, /actuator/configprops, or /actuator/beans
• Anomalous database access patterns following potential credential exposure
• Evidence of lateral movement using database credentials that were exposed through DolphinScheduler

Detection Strategies

• Monitor web server access logs for requests to Spring Boot Actuator endpoints from unauthorized sources
• Implement network-level monitoring to detect reconnaissance activity targeting management endpoints
• Deploy application-layer firewalls or web application firewalls (WAF) with rules to block unauthorized Actuator endpoint access
• Use SentinelOne's behavioral detection capabilities to identify suspicious API access patterns

Monitoring Recommendations

• Enable detailed logging for all management endpoint access in DolphinScheduler
• Configure alerting for any external access attempts to Actuator endpoints
• Regularly audit database access logs for connections from unexpected sources
• Implement continuous monitoring of configuration files for unauthorized changes

How to Mitigate CVE-2023-48796

Immediate Actions Required

• Upgrade Apache DolphinScheduler to version 3.0.2 or later immediately
• If immediate upgrade is not possible, apply the workaround configuration to restrict exposed endpoints
• Audit database credentials that may have been exposed and rotate them as a precaution
• Review access logs to determine if the vulnerability has been exploited
• Restrict network access to DolphinScheduler management interfaces using firewalls or network segmentation

Patch Information

Apache has released version 3.0.2 of DolphinScheduler which addresses this vulnerability by properly restricting management endpoint exposure. Users are strongly recommended to upgrade to this version or later. For detailed information, refer to the Apache Mailing List Thread and the Openwall OSS Security Discussion.

Workarounds

• Set the environment variable MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus to limit exposed endpoints
• Alternatively, modify the application.yaml configuration file to restrict endpoint exposure
• Place DolphinScheduler behind a reverse proxy that blocks access to /actuator/* paths from untrusted sources
• Implement network segmentation to ensure management endpoints are only accessible from trusted administrative networks

# Configuration to restrict management endpoint exposure
management:
  endpoints:
    web:
      exposure:
        include: health,metrics,prometheus