Apache ZooKeeper ACL Disclosure Vulnerability in Versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta
Summary
CVE-2019-0201: An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. Affects zookeeper versions < 3.4.13-2. Fixed in 3.4.13-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache ZooKeeper is a centralized service for maintaining configuration information, naming, providing distributed synchronization, and providing group services. It is widely used in distributed applications to manage large sets of data in a reliable and fault-tolerant manner. The vulnerability affects versions 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta, where the getACL() command does not enforce permission checks, leading to potential exposure of sensitive information.
Vulnerability Detail
The vulnerability arises from the getACL() command in Apache ZooKeeper, which fails to check permissions when retrieving the Access Control Lists (ACLs) of a requested node. This oversight allows unauthenticated or unprivileged users to access the ACL Id field, which may contain sensitive information, including unsalted hash values used for user authentication when DigestAuthenticationProvider is in use. The ramifications include unauthorized disclosure of user credentials, potentially leading to further exploitation of the system.
How To Fix
Minimum fixed version
3.4.13-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade zookeeperTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the ZooKeeper service to trusted users only, and ensure that the getACL() command is not exposed to unauthenticated users. Implementing network-level security measures, such as firewalls, can help mitigate the risk until a proper fix is applied.
Conclusion
The Apache ZooKeeper ACL disclosure vulnerability poses a significant risk to systems using affected versions. It is crucial to upgrade to a secure version to protect sensitive information and maintain the integrity of the system. Implementing temporary workarounds can help mitigate risks until a proper fix is applied.
See every vulnerability recorded for zookeeper →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
The affected versions are Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential consequences include unauthorized access to sensitive information, such as user authentication hashes, which could lead to further exploitation of the system.
Yes, you can restrict access to the ZooKeeper service and ensure that the getACL() command is not accessible to unauthenticated users as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for zookeeper.
