Horizon Alert
Summary of the vulnerability and why it matters
This advisory highlights a critical security flaw in Apache Pulsar's authorization component that could allow unauthenticated access to sensitive administrative functions and data. The vulnerability arises when specific authorization and authentication settings are enabled, potentially permitting attackers to bypass security checks and gain broad control over the system, including super-user privileges, by using forged or unsigned tokens.
- Unauthenticated access to critical controls is possible.
- Executive takeaway: Confirm relevance and confirm exposure.
- Leadership takeaway: Understand potential for unauthorized system control.
Attack Path
How an attacker could exploit the issue
An attacker could compromise Apache Pulsar by sending a forged or unsigned token to an unauthenticated HTTP request. This occurs when token authentication and authorization are enabled with a specific configuration that allows unauthenticated requests to fall back to an anonymous user role. The vulnerable `MultiRolesTokenAuthorizationProvider` then processes this token without verifying its signature, granting the attacker the roles specified in the token. This could lead to super-user access, allowing the attacker to manage tenants, namespaces, topics, and broker configurations.
- Unauthenticated network access required.
- An unverified JWT with role claims triggers the vulnerability.
- Risk of unauthorized super-user access.
Live Threat
Current exploitation, exposure, and threat context
In deployments using the MultiRolesTokenAuthorizationProvider with a non-empty anonymous user role, unauthenticated clients could exploit a flaw in token verification to gain unauthorized access to sensitive administrative functions and data. This occurs when HTTP requests with failed authentication fall back to the anonymous user role, allowing a forged or unsigned token with arbitrary roles to authorize actions. The affected components include the broker's HTTP endpoints, such as the admin REST API, and the WebSocket API.
- Administrative functions and configurations.
- Unauthenticated HTTP requests to APIs.
- Potential for super-user access and configuration changes.
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams responsible for Apache Pulsar deployments, including platform and security operations, must first identify all instances of the affected technology. Confirming reachability and business criticality is essential to prioritize remediation efforts, and the accountable owner should be engaged to plan mitigation based on assessed risk.
- Platform and security teams own the issue.
- Verify Pulsar deployment with MultiRolesTokenAuthorizationProvider.
- Plan risk-based remediation and vendor coordination.
