PT-2023-26015 · Apache · Apache Pulsar Websocket Proxy

Michael Marshall · CVE-2023-37544 · Published 2023-12-20 · Updated 2024-01-04

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Pulsar WebSocket Proxy versions 2.8.0 through 2.8.* Apache Pulsar WebSocket Proxy versions 2.9.0 through 2.9.* Apache Pulsar WebSocket Proxy versions 2.10.0 through 2.10.4 Apache Pulsar WebSocket Proxy versions 2.11.0 through 2.11.1 Apache Pulsar WebSocket Proxy version 3.0.0

Description An Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the "/pingpong" endpoint without authentication. The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

Recommendations For Apache Pulsar WebSocket Proxy versions 2.8.0 through 2.8., upgrade to at least version 2.10.5, 2.11.2, or 3.0.1. For Apache Pulsar WebSocket Proxy versions 2.9.0 through 2.9., upgrade to at least version 2.10.5, 2.11.2, or 3.0.1. For Apache Pulsar WebSocket Proxy versions 2.10.0 through 2.10.4, upgrade to at least version 2.10.5. For Apache Pulsar WebSocket Proxy versions 2.11.0 through 2.11.1, upgrade to at least version 2.11.2. For Apache Pulsar WebSocket Proxy version 3.0.0, upgrade to at least version 3.0.1.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-37544

GHSA-83Q5-WHQP-R8JR

Affected Products

Apache Pulsar Websocket Proxy

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37544.json · Exploit
• https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37544 · Security Note
• https://osv.dev/vulnerability/GHSA-83q5-whqp-r8jr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37544 · Vendor Advisory
• https://github.com/apache/pulsar · Note
• https://github.com/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a · Note
• https://github.com/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f · Note
• https://github.com/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358 · Note
• https://twitter.com/RedPacketSec/status/1737776248347078853 · Twitter Post
• https://t.me/cvenotify/64361 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1737406647545299124 · Twitter Post
• https://twitter.com/CVEnew/status/1737395544933167335 · Twitter Post
• https://t.me/cvenotify/66238 · Telegram Post
• http://openwall.com/lists/oss-security/2023/12/20/2 · Note