Log in Start free

Vulnerability · Published Oct 11, 2023 · Assigned by apache

CVE-2023-44981Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication

Critical 9.1

In plain English

A critical-severity authorization bypass via user-controlled key in Apache ZooKeeper from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)2.2%top 17.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue. See the documentation for more details on correct cluster administration.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12zookeeper3.8.0-11+deb12u1DEBIAN-CVE-2023-44981
Debian:12zookeeper3.8.0-11+deb12u1DSA-5544-1
Debian:13zookeeper3.9.1-1DEBIAN-CVE-2023-44981
Debian:14zookeeper3.9.1-1DEBIAN-CVE-2023-44981
Mavenorg.apache.zookeeper:zookeeper3.9.1GHSA-7286-pgfv-vxvh
Mavenorg.apache.zookeeper:zookeeper3.7.2GHSA-7286-pgfv-vxvh
Mavenorg.apache.zookeeper:zookeeper3.8.3GHSA-7286-pgfv-vxvh
Ubuntu:22.04:LTSzookeeper3.4.13-6ubuntu4.1UBUNTU-CVE-2023-44981
Ubuntu:22.04:LTSzookeeper3.4.13-6ubuntu4.1USN-6559-1

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache ZooKeeper 3.9.0 – before 3.9.13.8.0 – through 3.8.23.7.0 – through 3.7.10 – before 3.7.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References