CVE-2023-30429: Apache Pulsar Incorrect Authorization Vulnerability
Summary
CVE-2023-30429: Apache Pulsar Incorrect Authorization vulnerability. Affects org.apache.pulsar:pulsar across 2 version ranges.
< 2.10.4
>= 2.11.0, < 2.11.1
Fixed in 2.10.4 or 2.11.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Pulsar is an open-source distributed pub-sub messaging system that provides high-performance, durable messaging and event streaming. It is widely used for building real-time analytics, IoT, and other streaming applications. However, an Incorrect Authorization vulnerability has been discovered in Apache Pulsar.
Vulnerability Detail
The vulnerability affects Apache Pulsar versions before 2.10.4 and 2.11.0. When a client connects to the Pulsar Function Worker via the Pulsar Proxy using mTLS authentication, the Pulsar Function Worker incorrectly performs authorization by using the Proxy's role instead of the client's role. This can lead to privilege escalation, especially if the proxy is configured with a superuser role. Attackers could exploit this vulnerability to gain unauthorized access and perform unauthorized actions within the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.10.42.10.4 -
>= 2.11.0, < 2.11.12.11.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Incorrect Authorization vulnerability in Apache Pulsar can lead to privilege escalation and unauthorized access. It is crucial to upgrade the Pulsar Function Worker to the patched versions mentioned above to mitigate this vulnerability. For further support and assistance in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.pulsar:pulsar →
FAQ
Apache Pulsar is an open-source distributed pub-sub messaging system used for building real-time analytics, IoT, and other streaming applications.
The vulnerability allows for privilege escalation, potentially granting unauthorized access and unauthorized actions within the system.
Versions before 2.10.4 and 2.11.0 of Apache Pulsar are affected.
Upgrade the Pulsar Function Worker to a patched version. Refer to the provided fix instructions for the specific versions.
No specific workaround has been provided for this vulnerability. Upgrading to the patched versions is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.pulsar:pulsar.
