Apache IoTDB is an industrial IoT time-series database management system that adopts a lightweight architecture with edge-cloud collaboration, supporting integrated collection, storage, management, and analysis of IoT time-series data. It features multi-protocol compatibility, ultra-high compression ratio, high-throughput read/write capabilities, industrial-grade stability, and minimal maintenance requirements.
Apache IoTDB is affected by an authenticated server-side request forgery (SSRF) in its user-defined function mechanism. CREATE FUNCTION … USING URI makes the DataNode download the UDF implementation from a user-supplied URI, validating only that the scheme is set and not file, with no host/scheme allowlist. A user holding the USE_UDF privilege (grantable to non-super users) can therefore force the server to issue arbitrary outbound requests to internal services or cloud-metadata endpoints. The fetched resource is a remote JAR that is then loaded and executed; because USE_UDF already grants server-side code execution, the JAR load is not a new capability, but the unauthenticated, plain-HTTP, integrity-unchecked remote fetch is an additional supply-chain/MITM hardening gap.