Critical ArangoDB Flaws Allow Authentication Bypass and Remote Code Execution as Root
Two serious flaws in ArangoDB let attackers bypass login checks and run commands as the server's admin user. No password is needed, and the attack works on any exposed ArangoDB server running version 3.12.10.1 or earlier.
- Report priority
- High
How it works
- Attackers send a specially crafted request to the ArangoDB server.
- The server checks if the request starts with a protected path like /_api, but it does not properly decode the URL before checking.
- This lets attackers trick the server into thinking the request is public, bypassing login checks.
- Once logged in, attackers can read or change database data and run commands as the server's admin user.
What to do
Check your installed ArangoDB version by running arangodb --version in the terminal. If the version is 3.12.10.1 or earlier, you are affected. If you use Docker, check the version inside the container with docker exec -it <container_name> arangodb --version.
Update ArangoDB to version 3.12.11 or later immediately. Follow the official update instructions from the ArangoDB documentation. If you cannot update right away, disable public access to your ArangoDB server until you can apply the fix.
Technical details
Two critical flaws in ArangoDB (tracked as GHSA-rrgq-978q-36mq and GHSA-rvhw-4hpw-9vrx) allow attackers to bypass authentication and execute arbitrary code as the root user on the underlying system. The first vulnerability (CVSS 9.8) affects versions through 3.12.10.1 and exploits a URL parsing inconsistency: the authentication system checks the raw URL, while the routing logic decodes it. By encoding the underscore in /api as %5f, attackers can trick the server into treating a restricted API endpoint as public, granting unauthorized access to database actions, including retrieving the root account's weak SHA-256 password hash (one round with a 32-bit salt).
The second flaw (CVSS 9.9) lets users with write permissions set a task's isSystem flag to true, forcing execution in the server's privileged context and achieving remote code execution. Both issues stem from improper validation of user-supplied input in the HTTP interface. No patch or fixed version was disclosed in the source.