CVE-2024-27317highCWE-22

CVE-2024-27317: high-severity vulnerability in Apache Pulsar

Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

Published · Updated

Follow this CVE+ Monitor Apache Pulsar+ Monitor org.apache.pulsar:pulsar-functions-worker

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.4epss 57%
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product
Red Hat Fuse 7
workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Not affected
4 products — because the vulnerable code is not present in the product
Red Hat Integration Camel K 1 · Red Hat JBoss Enterprise Application Platform 8 · Red Hat build of Apache Camel for Spring Boot 3 · Red Hat build of Apache Camel for Spring Boot 4
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Affected products
Apache Software Foundation · Apache Pulsar
Related CVEs — Apache Pulsar

In the same product, most dangerous first.

CVE-2021-22160—Authentication with JWT allows use of “none”-algorithmEPSS 52.9%CVE-2024-27135HIGHApache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionEPSS 6.0%CVE-2024-27894HIGHApache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS ProxyingEPSS 1.9%CVE-2022-34321HIGHApache Pulsar: Improper Authentication for Pulsar Proxy Statistics EndpointEPSS 1.8%CVE-2021-41571—Pulsar Admin API allows access to data from other tenants using getMessageById APIEPSS 1.7%CVE-2024-28098MEDIUMApache Pulsar: Improper Authorization For Topic-Level Policy ManagementEPSS 1.7%