CVE-2023-25560: 
DataHub vulnerability analysis and mitigation

CVE-2023-25560 is a JSON Injection vulnerability discovered in DataHub's frontend that affects version v0.8.44. The vulnerability was disclosed on January 6, 2023. The issue exists in the AuthServiceClient component where multiple JSON strings are crafted using user-controlled data (GitHub Advisory).

The vulnerability occurs when the AuthServiceClient crafts JSON strings using format strings with user-controlled data. These JSON strings are then sent to the backend and parsed using the Jackson library. Due to the way Jackson handles colliding keys by using the last appearing value in the string, an attacker may be able to inject arbitrary fields in the JSON string that could shadow values added by the frontend (GitHub Advisory).

This vulnerability can be exploited to generate JWT tokens for arbitrary accounts or create arbitrary native accounts, including system admin accounts. The ability to create system accounts effectively leads to full system compromise, as these accounts have elevated privileges (GitHub Advisory).

The vulnerability was fixed in DataHub version v0.8.45. Users are advised to upgrade to this version or later to protect against this vulnerability (GitHub Advisory).