CVE-2024-27317
published 2024-03-12CVE-2024-27317: In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions…
PriorityP279critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
56.93%
99.0th percentile
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".
This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0.
2.10 Pulsar Function Worker users should upgrade to at least 2.10.6.
2.11 Pulsar Function Worker users should upgrade to at least 2.11.4.
3.0 Pulsar Function Worker users should upgrade to at least 3.0.3.
3.1 Pulsar Function Worker users should upgrade to at least 3.1.3.
3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.
Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | pulsar | — | — |
| apache | pulsar | >= 2.11.0 < 2.11.4 | 2.11.4 |
| apache | pulsar | >= 2.4.0 < 2.10.6 | 2.10.6 |
| apache | pulsar | >= 3.0.0 < 3.0.3 | 3.0.3 |
| apache | pulsar | >= 3.1.0 < 3.1.3 | 3.1.3 |
| apache_software_foundation | apache_pulsar | >= 2.11.0 < 2.11.4 | 2.11.4 |
| apache_software_foundation | apache_pulsar | >= 2.4.0 < 2.10.6 | 2.10.6 |
| apache_software_foundation | apache_pulsar | >= 3.0.0 < 3.0.3 | 3.0.3 |
| apache_software_foundation | apache_pulsar | >= 3.1.0 < 3.1.3 | 3.1.3 |
| apache_software_foundation | apache_pulsar | >= 3.2.0 < 3.2.1 | 3.2.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect directory traversal attempts in zip/jar/nar file uploads to Pulsar Functions Worker — look for filenames containing '..' path elements within uploaded archive files ↗
- →Monitor Pulsar Functions Worker for file creation or modification events outside the designated extraction directory, which may indicate successful exploitation of this zip-slip vulnerability ↗
- →Flag authenticated uploads of .jar or .nar files to Pulsar Functions Worker endpoints as a potential attack vector for this CVE ↗
- →Pulsar Broker instances configured with 'functionsWorkerEnabled=true' are also vulnerable and should be included in detection/monitoring scope ↗
- ·Pulsar Broker is only vulnerable when explicitly configured with functionsWorkerEnabled=true; default broker deployments without this setting are not affected ↗
- ·Exploitation requires an authenticated user — unauthenticated attackers cannot directly trigger this vulnerability ↗
- ·No mitigation short of patching is available per Red Hat Product Security assessment ↗
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
ghsa·2024-03-12
CVE-2024-27317 [CRITICAL] CWE-22 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".
This issue affects Apac
OSV
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
osv·2024-03-12
CVE-2024-27317 [CRITICAL] Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".
This issue affects Apac
Red Hat
apache-pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
vendor_redhat·2024-03-12·CVSS 8.4
CVE-2024-27317 [HIGH] CWE-22 apache-pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
apache-pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".
This issue affects Apach
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2024/03/12/10https://lists.apache.org/thread/ct9xmvlf7lompc1pxvlsb60qstfsm9pohttps://pulsar.apache.org/security/CVE-2024-27317/http://www.openwall.com/lists/oss-security/2024/03/12/10https://lists.apache.org/thread/ct9xmvlf7lompc1pxvlsb60qstfsm9pohttps://pulsar.apache.org/security/CVE-2024-27317/
2024-03-12
Published