cbcvebase.
CVE-2023-44981
published 2023-10-11

CVE-2023-44981: Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper…

PriorityP261critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
1.71%
74.8th percentile
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like '[email protected]', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue. See the documentation for more details on correct cluster administration.

Affected

20 ranges
VendorProductVersion rangeFixed in
apachezookeeper< 3.7.23.7.2
apachezookeeper
apachezookeeper>= 0 < 3.4.13-6+deb11u13.4.13-6+deb11u1
apachezookeeper>= 0 < 3.8.0-11+deb12u13.8.0-11+deb12u1
apachezookeeper>= 0 < 3.9.1-13.9.1-1
apachezookeeper>= 0 < 3.9.1-13.9.1-1
apachezookeeper>= 0 < 3.4.13-5ubuntu0.13.4.13-5ubuntu0.1
apachezookeeper>= 0 < 3.4.13-6ubuntu4.13.4.13-6ubuntu4.1
apachezookeeper>= 0 < 3.4.5+dfsg-1ubuntu0.1~esm33.4.5+dfsg-1ubuntu0.1~esm3
apachezookeeper>= 0 < 3.4.8-1ubuntu0.1~esm23.4.8-1ubuntu0.1~esm2
apachezookeeper>= 0 < 3.4.13-3ubuntu0.1~esm13.4.13-3ubuntu0.1~esm1
apachezookeeper>= 3.8.0 < 3.8.33.8.3
apache_software_foundationapache_zookeeper< 3.7.03.7.0
apache_software_foundationapache_zookeeper3.7.0 – 3.7.1
apache_software_foundationapache_zookeeper3.8.0 – 3.8.2
apache_software_foundationapache_zookeeper>= 3.9.0 < 3.9.13.9.1
debiandebian_linux
debiandebian_linux
debiandebian_linux
debianzookeeper< zookeeper 3.8.0-11+deb12u1 (bookworm)zookeeper 3.8.0-11+deb12u1 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

  • Authorization bypass is triggered when the instance part of the SASL authentication ID is missing (e.g., only realm present like '[email protected]'). Detect peers joining the ZooKeeper quorum whose SASL ID contains no instance/host component before the '@' separator.
  • Monitor ZooKeeper quorum/election traffic for unexpected peers joining the cluster, especially those presenting SASL credentials without an instance part, which would indicate exploitation of this bypass.
  • This vulnerability is only exploitable when quorum.auth.enableSasl=true is set in zoo.cfg. Audit ZooKeeper configurations for this setting to identify exposed instances.
  • A malicious actor exploiting this flaw would use a SASL authentication ID with a non-existing or absent instance part to bypass the peer authorization controller and join the ZooKeeper ensemble.
  • ·The vulnerability is NOT exploitable unless SASL Quorum Peer authentication is explicitly enabled. Default ZooKeeper deployments are not affected.
  • ·Red Hat AMQ 7 Broker and AMQ Streams 2 use ZooKeeper but do not enable Peer Authentication, so the vulnerable code path is not reachable in those products.
  • ·Red Hat Fuse 7 uses ZooKeeper but does not use any of its server capabilities, making it not vulnerable to this specific flaw.
  • ·As a network-level mitigation (not a fix), protecting ZooKeeper ensemble election/quorum communication with a firewall will prevent exploitation.

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
osv9.1CRITICAL
vendor_debian9.1CRITICAL
vendor_oracle9.1CRITICAL
vendor_redhat9.1CRITICAL
vendor_ubuntu5.9MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.