The Hidden Backdoor in Your Databricks Audit Logs

Audit logs provide visibility into user and system activity, helping organizations detect unusual behavior, investigate incidents, and meet compliance requirements. However, if misconfigured or improperly managed, logs can also expose sensitive data that attackers may exploit.

Session tokens are temporary credentials that keep users authenticated. In Databricks, if these tokens are exposed in Unity Catalog audit logs, attackers can reuse them to impersonate legitimate users and gain unauthorized access.

Session hijacking occurs when an attacker steals a valid Databricks session token, such as a JSESSIONID, and uses it to bypass authentication. This attack gives the attacker full control of the user’s session until the token is revoked or expires.

Signs of session hijacking in Databricks include unexpected logins from unfamiliar IPs or locations, unexplained data access, bulk queries or rapid API calls, and account activity that doesn’t match the user’s normal behavior. Monitoring audit logs for anomalies and setting alerts on unusual session patterns can help detect hijacking attempts quickly.

A critical Databricks weakness was the exposure of unredacted session IDs in the Unity Catalog audit logs. These values contained raw JSESSIONID tokens that attackers could extract, reformat, and inject to hijack user sessions. With a valid token, an attacker could impersonate the user, bypass login, and gain full access to Databricks workspaces and administrative functions until the session expired or was revoked.

Firewalls block unauthorized network traffic but do not prevent session hijacking if an attacker already has a valid session token. Protecting Databricks environments requires securing audit logs, redacting sensitive session IDs, enforcing strong IAM policies, and monitoring for abnormal user behavior.

The principle of least privilege ensures users and systems only have the minimum access required to perform their tasks. Restricting access to sensitive logs and creating secure views for broader use can significantly reduce the risk of data exposure.

Organizations should regularly review permissions to audit logs, implement secure views to redact or hash sensitive fields, and configure proactive monitoring for suspicious activity. Continuous security reviews of logging and monitoring tools are essential.

It highlights that even trusted security tools can inadvertently introduce identity risks. Strong IAM policies, regular audits, and continuous monitoring are critical to ensure cloud environments remain secure.