CVE-2024-27135 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution
A malicious authenticated user can execute arbitrary Java code on the Pulsar Function Worker, bypassing sandbox restrictions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27135?
CVE-2024-27135 is a high-severity code injection vulnerability in Apache Pulsar, published on 12 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".
This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0.
2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.
Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
Which versions are affected by CVE-2024-27135?
10 open source packages ship an affected version, including org.apache.pulsar:pulsar-functions-worker. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.pulsar:pulsar-functions-worker Maven | From 2.11.0 | 2.11.4 |
org.apache.pulsar:pulsar-functions-worker Maven | From 2.11.0 | 2.11.4 |
org.apache.pulsar:pulsar-functions-worker Maven | From 2.4.0 | 2.10.6 |
org.apache.pulsar:pulsar-functions-worker Maven | From 2.4.0 | 2.10.6 |
org.apache.pulsar:pulsar-functions-worker Maven | From 3.0.0 | 3.0.3 |
org.apache.pulsar:pulsar-functions-worker Maven | From 3.0.0 | 3.0.3 |
4 more packages
org.apache.pulsar:pulsar-functions-worker Maven | From 3.1.0 | 3.1.3 |
org.apache.pulsar:pulsar-functions-worker Maven | From 3.1.0 | 3.1.3 |
org.apache.pulsar:pulsar-functions-worker Maven | From 3.2.0 | 3.2.1 |
org.apache.pulsar:pulsar-functions-worker Maven | From 3.2.0 | 3.2.1 |
Products include Apache Pulsar.
How do I fix CVE-2024-27135?
Upgrade org.apache.pulsar:pulsar-functions-worker to a fixed version for your release line: 2.11.4, 2.10.6, 3.0.3 or 3.1.3.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-27135 being exploited?
There is no known exploitation of CVE-2024-27135 in the wild and no public exploit code.
Other vulnerabilities in Apache Pulsar
- CVE-2021-22160 Authentication with JWT allows use of “none”-algorithm
- CVE-2023-30429 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy
- CVE-2024-27894 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
- CVE-2024-27317 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
- CVE-2022-34321 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint
Sources
Also known as GHSA-xp2r-g8qq-44hh.