CVE-2022-34321
📋 TL;DR
Apache Pulsar Proxy has an improper authentication vulnerability that allows unauthenticated access to the /proxy-stats endpoint. This exposes connection statistics and allows logging level manipulation, potentially leading to information disclosure or denial-of-service. Affected versions range from 2.6.0 through multiple major releases up to 3.1.0.
💻 Affected Systems
- Apache Pulsar Proxy
📦 What is this software?
Pulsar by Apache
Pulsar by Apache
Pulsar by Apache
Pulsar by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive connection data including client IPs and manipulate logging levels to cause denial-of-service through excessive logging overhead.
Likely Case
Unauthorized access to proxy statistics revealing connection details and potential logging manipulation in exposed environments.
If Mitigated
Minimal impact if proxy is properly isolated within secured network per architectural design.
🎯 Exploit Status
Direct HTTP access to /proxy-stats endpoint without authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.10.6, 2.11.3, 3.0.2, 3.1.1 or newer
Vendor Advisory: https://pulsar.apache.org/security/CVE-2022-34321/
Restart Required: Yes
Instructions:
1. Identify current Pulsar Proxy version. 2. Upgrade to patched version based on major release: 2.10.x → 2.10.6+, 2.11.x → 2.11.3+, 3.0.x → 3.0.2+, 3.1.x → 3.1.1+. 3. Restart Pulsar Proxy service.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict network access to Pulsar Proxy endpoints using firewall rules
iptables -A INPUT -p tcp --dport <proxy-port> -s <trusted-networks> -j ACCEPT
iptables -A INPUT -p tcp --dport <proxy-port> -j DROP
Reverse Proxy Authentication
allPlace Pulsar Proxy behind authenticated reverse proxy
🧯 If You Can't Patch
- Implement strict network segmentation to prevent unauthorized access to Pulsar Proxy
- Deploy web application firewall with authentication requirements for /proxy-stats endpoint
🔍 How to Verify
Check if Vulnerable:
Attempt HTTP GET request to http://<pulsar-proxy>:<port>/proxy-stats without authentication. If it returns statistics data, system is vulnerable.Check Version:
Check Pulsar Proxy logs or run: pulsar-admin brokers version (if admin access available)Verify Fix Applied:
After patching, attempt same unauthenticated request to /proxy-stats endpoint. Should return authentication error or 403 Forbidden.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /proxy-stats endpoint
- Sudden increase in logging volume from proxy
Network Indicators:
- Unusual traffic patterns to /proxy-stats endpoint
- External IPs accessing proxy statistics
SIEM Query:
source="pulsar-proxy" AND (uri_path="/proxy-stats" OR message="*proxy-stats*") AND NOT (user="authenticated_user")🔗 References
- http://www.openwall.com/lists/oss-security/2024/03/12/8
- https://lists.apache.org/thread/ods5tq2hpl390hvjnvxv0bcg4rfpgjj8
- https://pulsar.apache.org/security/CVE-2022-34321/
- http://www.openwall.com/lists/oss-security/2024/03/12/8
- https://lists.apache.org/thread/ods5tq2hpl390hvjnvxv0bcg4rfpgjj8
- https://pulsar.apache.org/security/CVE-2022-34321/
