Platform
apache
Component
apache-pulsar
Fixed in
2.10.6
2.11.4
3.0.3
3.1.3
3.2.1
CVE-2024-27317 describes a directory traversal vulnerability within the Apache Pulsar Functions Worker. Authenticated users can exploit this flaw by uploading malicious JAR or NAR files, effectively ZIP archives, which contain filenames with directory traversal sequences like "..". This allows attackers to potentially create or modify files outside the intended extraction directory, leading to system compromise. The vulnerability impacts Pulsar versions 2.4.0 through 3.2.1, and a fix is available in version 3.2.1.
The core of this vulnerability lies in the Functions Worker's lack of proper validation of filenames within uploaded JAR and NAR files. An attacker, possessing valid authentication credentials, can craft a malicious function package containing filenames designed to traverse directories. For example, a filename like "../../../../etc/passwd" could allow an attacker to overwrite or create files in sensitive system locations. This could lead to arbitrary code execution, data exfiltration, or denial of service. The potential impact extends beyond simple file modification; an attacker could potentially inject malicious code into the Pulsar environment, gaining persistent access and control. The blast radius is significant, as a compromised Pulsar cluster could impact all applications and services relying on it.
CVE-2024-27317 was publicly disclosed on March 12, 2024. While no active exploitation campaigns have been definitively confirmed at the time of writing, the ease of exploitation and the potential impact make it a high-priority vulnerability. There are currently no public proof-of-concept exploits available, but the vulnerability's nature suggests that such exploits are likely to emerge. It is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
1.03% (77% percentile)
CVSS Vector
The primary mitigation for CVE-2024-27317 is to immediately upgrade Apache Pulsar to version 3.2.1 or later, which includes the necessary fixes. If upgrading is not immediately feasible, consider implementing temporary workarounds. One approach is to restrict the types of files that can be uploaded as Pulsar functions, limiting the attack surface. Additionally, implement strict input validation on all uploaded files, specifically sanitizing filenames to prevent directory traversal sequences. Web Application Firewalls (WAFs) configured to detect and block requests containing suspicious filenames can also provide a layer of defense. Monitor Pulsar logs for unusual file creation or modification activity, particularly in unexpected directories. After upgrading, confirm the fix by attempting to upload a test function with a malicious filename (e.g., "../../../../tmp/testfile") and verifying that the upload fails with an appropriate error message.
Actualice Apache Pulsar a la versión 2.10.6 o superior si está utilizando la serie 2.10. Actualice a la versión 2.11.4 o superior si está utilizando la serie 2.11. Para las series 3.0, 3.1 y 3.2, actualice a las versiones 3.0.3, 3.1.3 y 3.2.1 respectivamente, o a una versión más reciente.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2024-27317 is a HIGH severity vulnerability in Apache Pulsar versions 2.4.0–3.2.1 where malicious function uploads can exploit a directory traversal flaw, potentially allowing unauthorized file access and modification.
If you are running Apache Pulsar versions 2.4.0 through 3.2.1, you are potentially affected by this vulnerability. Immediate action is required.
The recommended fix is to upgrade Apache Pulsar to version 3.2.1 or later. Temporary workarounds include restricting file uploads and implementing strict filename validation.
While no active exploitation campaigns have been definitively confirmed, the vulnerability's nature and potential impact suggest that exploitation is likely. Monitor your systems closely.
Refer to the official Apache Pulsar security advisory for detailed information and updates: [https://pulsar.apache.org/security/CVE-2024-27317/](https://pulsar.apache.org/security/CVE-2024-27317/)
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.