PT-2022-5873 · Apache · Apache Pulsar C++ Client+1

Michael Rowley · Published 2022-11-04 · Updated 2023-01-26 · CVE-2022-33684

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Pulsar C++ Client versions 2.7.0 through 2.7.4 Apache Pulsar C++ Client versions 2.8.0 through 2.8.3 Apache Pulsar C++ Client versions 2.9.0 through 2.9.2 Apache Pulsar C++ Client versions 2.10.0 through 2.10.1 Apache Pulsar C++ Client version 2.6.4 and earlier Apache Pulsar Python Client versions 2.7.0 through 2.7.4 Apache Pulsar Python Client versions 2.8.0 through 2.8.3 Apache Pulsar Python Client versions 2.9.0 through 2.9.2 Apache Pulsar Python Client versions 2.10.0 through 2.10.1 Apache Pulsar Python Client version 2.6.4 and earlier

Description The Apache Pulsar C++ Client and Python Client do not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This allows an attacker to perform a man-in-the-middle attack and intercept and/or modify the GET request sent to the ClientCredentialFlow "issuer url". The intercepted credentials can be used to acquire authentication data from the OAuth2.0 server to then authenticate with an Apache Pulsar cluster. An attacker must take control of a machine "between" the client and the server and actively manipulate traffic to perform the attack.

Recommendations 2.7 C++ and Python Client users should upgrade to 2.7.5 and rotate vulnerable OAuth2.0 credentials, including client id and client secret. 2.8 C++ and Python Client users should upgrade to 2.8.4 and rotate vulnerable OAuth2.0 credentials, including client id and client secret. 2.9 C++ and Python Client users should upgrade to 2.9.3 and rotate vulnerable OAuth2.0 credentials, including client id and client secret. 2.10 C++ and Python Client users should upgrade to 2.10.2 and rotate vulnerable OAuth2.0 credentials, including client id and client secret. Any users running the C++ and Python Client for 2.6 or less should upgrade to one of the above patched versions and rotate vulnerable OAuth2.0 credentials, including client id and client secret.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2022-07288

CVE-2022-33684

GHSA-5R3H-C3R7-9W4H

Affected Products

Apache Pulsar C++ Client

Apache Pulsar Python Client

References · 12

• 🔥 https://huntr.dev/bounties/df89b724-3201-47aa-b8cd-282e112a566f · Exploit
• https://lists.apache.org/thread/ky1ssskvkj00y36k7nys9b5gm5jjrzwv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-33684 · Security Note
• https://bdu.fstec.ru/vul/2022-07288 · Security Note
• https://osv.dev/vulnerability/CVE-2022-33684 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5r3h-c3r7-9w4h · Vendor Advisory
• https://github.com/apache/pulsar/pull/16064 · Note
• https://github.com/apache/pulsar-client-cpp · Note
• https://t.me/cibsecurity/52559 · Telegram Post
• https://pulsar.apache.org/download · Note
• https://t.me/cvenotify/37247 · Telegram Post
• https://t.me/pentestingnews/29921 · Telegram Post