Missing authorization in Apache Pulsar

1) Missing Authorization

EUVDB-ID: #VU87558

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-34321

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to the application.

The vulnerability exists due to missing authorization at the "/proxy-stats" endpoint. A remote non-authenticated attacker can use the endpoint to view detailed statistics about live connections and modify the logging level of proxied connections.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Pulsar: 2.6.0 - 3.1.0

External links

http://lists.apache.org/thread/ods5tq2hpl390hvjnvxv0bcg4rfpgjj8
http://pulsar.apache.org/security/CVE-2022-34321/
http://lists.apache.org/thread/0j7n7cos96ys701cg5bj0ck2gq92p1qk
http://lists.apache.org/thread/0f49dyo45ccdplwvogtzm5ddrxcnwrz5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.