Apache ZooKeeper up to 3.9.2 HTTP Request Header improper authentication

Summaryinfo

A vulnerability was found in Apache ZooKeeper up to 3.9.2. It has been declared as critical. This affects an unknown function of the component HTTP Request Header Handler. Executing a manipulation can lead to improper authentication. The identification of this vulnerability is CVE-2024-51504. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Apache ZooKeeper up to 3.9.2 and classified as critical. This vulnerability affects some unknown processing of the component HTTP Request Header Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue.

The advisory is shared for download at lists.apache.org. This vulnerability was named CVE-2024-51504 since 10/28/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 210584 (Apache ZooKeeper 3.9.x < 3.9.3 Authentication Bypass), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.9.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (210584). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• ZooKeeper

Version

• 3.9.0
• 3.9.1
• 3.9.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion