CVE-2024-6322

What it actually does

The ReqActions check in plugin.json is not scoped per datasource, allowing any account with query access to one data source to bypass protections on another.

Why it matters to the business

Attackers with limited access can reach additional data sources, increasing risk of unauthorized data exposure or modification across the environment.

How an attack unfolds

An attacker first obtains query access to any single data source, then issues requests against a protected plugin datasource; because the authorization check is not datasource-specific the ReqActions restriction is ignored and the query succeeds.

How to fix it

Upgrade to a version that enforces datasource-scoped ReqActions checks; until then restrict service-account permissions to the minimum required datasources.

How to confirm the fix worked

Review plugin.json configurations and test that accounts with access to one datasource cannot query any other datasource they lack explicit rights to.

Typical attack path

1. Gain query access to at least one data source
2. Identify a second datasource protected by ReqActions
3. Submit query using existing credentials
4. Bypass per-datasource authorization due to missing scope check

How to detect it

Search authentication and query logs for accounts accessing multiple distinct datasources in rapid succession or for queries against plugin datasources that previously returned access-denied responses.

What your security team should do

• Audit all service accounts for excessive datasource grants
• Apply the vendor patch that restores per-datasource scoping
• Add runtime authorization tests that verify datasource isolation