PT-2024-2611 · Apache · Apache Pulsar

Lari Hotari · Published 2024-03-12 · Updated 2025-01-19 · CVE-2024-27894

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Pulsar versions prior to 2.10.6 Apache Pulsar versions prior to 2.11.4 Apache Pulsar versions prior to 3.0.3 Apache Pulsar versions prior to 3.1.3 Apache Pulsar versions prior to 3.2.1

Description The issue is related to the Pulsar Functions Worker, which allows authenticated users to create functions where the function's implementation is referenced by a URL. This feature introduces a vulnerability that can be exploited by an attacker to gain unauthorized access to any file that the Pulsar Functions Worker process has permissions to read, including reading the process environment which potentially includes sensitive information, such as secrets. Furthermore, an attacker could leverage this vulnerability to use the Pulsar Functions Worker as a proxy to access the content of remote HTTP and HTTPS endpoint URLs, such as "http" or "https" schemes, and carry out denial of service attacks. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".

Recommendations For versions prior to 2.10.6, upgrade to at least 2.10.6. For versions prior to 2.11.4, upgrade to at least 2.11.4. For versions prior to 3.0.3, upgrade to at least 3.0.3. For versions prior to 3.1.3, upgrade to at least 3.1.3. For versions prior to 3.2.1, upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. As a temporary workaround, consider restricting access to the additionalEnabledConnectorUrlPatterns and additionalEnabledFunctionsUrlPatterns configuration keys to minimize the risk of exploitation.

Fix

RCE

Files Accessible to External Parties

Weakness Enumeration

CWE-20

CWE-552

Related Identifiers

BDU:2024-02678

CVE-2024-27894

GHSA-C2X9-VW5H-39VC

Affected Products

Apache Pulsar

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-27894 · Security Note
• https://pulsar.apache.org/security/CVE-2024-27894 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02678 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27894 · Vendor Advisory
• https://lists.apache.org/thread/45cqhgqg8d19ongjw18ypcss8vwh206p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c2x9-vw5h-39vc · Vendor Advisory
• https://github.com/apache/pulsar · Note
• https://twitter.com/CVEnew/status/1767620967583338672 · Twitter Post
• https://t.me/cvenotify/107891 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1767607341661188208 · Twitter Post
• https://t.me/cvenotify/73642 · Telegram Post
• https://t.me/cvenotify/73707 · Telegram Post
• https://twitter.com/oss_security/status/1767597928489660454 · Twitter Post
• https://twitter.com/socradar/status/1768250147421425871 · Twitter Post
• http://openwall.com/lists/oss-security/2024/03/12/11 · Note