CVE-2023-44981
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper.
Technology
Apache ZooKeeper
CVSS Score
9.1 / 10.0
Affected Versions
<3.7.2; >=3.8.0 <3.8.3; 3.9.0
Upstream Fix
See upstream advisory
Published
October 11, 2023
OSSeva Coverage
Fixed upstream
Description
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled
Is your Apache ZooKeeper deployment affected?
If you're running <3.7.2; >=3.8.0 <3.8.3; 3.9.0, you need this patch. Book a discovery call to get covered.