CVE-2023-50976
📋 TL;DR
Redpanda versions before 23.1.21 and 23.2.x before 23.2.18 have missing authorization checks in the Transactions API, allowing unauthorized users to perform transaction operations. This affects all Redpanda deployments using vulnerable versions, potentially exposing transaction data and operations.
💻 Affected Systems
- Redpanda
📦 What is this software?
Redpanda by Redpanda
Redpanda by Redpanda
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized actors could manipulate, delete, or corrupt transaction data across the entire Redpanda cluster, leading to data loss, integrity violations, and service disruption.
Likely Case
Unauthorized users accessing the Transactions API to read or modify transaction data, potentially exposing sensitive information or causing data inconsistencies.
If Mitigated
With proper network segmentation and access controls, impact is limited to authorized internal users only.
🎯 Exploit Status
Exploitation requires access to the Transactions API endpoint but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.1.21 or 23.2.18
Vendor Advisory: https://github.com/redpanda-data/redpanda/security/advisories
Restart Required: Yes
Instructions:
1. Backup your Redpanda configuration and data. 2. Upgrade to Redpanda 23.1.21 or 23.2.18 using your package manager. 3. Restart Redpanda services. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Redpanda Transactions API endpoints
iptables -A INPUT -p tcp --dport 9644 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 9644 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Redpanda cluster from untrusted networks
- Deploy a reverse proxy or API gateway with authentication/authorization in front of Redpanda Transactions API
🔍 How to Verify
Check if Vulnerable:
Check Redpanda version: rpk version or check service logs for version informationCheck Version:
rpk versionVerify Fix Applied:
Verify version is 23.1.21 or higher, or 23.2.18 or higher, and test Transactions API with unauthorized user📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Transactions API endpoints
- Transaction operations from unexpected IP addresses
Network Indicators:
- Unusual traffic patterns to port 9644
- Transaction API requests without authentication headers
SIEM Query:
source="redpanda" AND ("transaction" OR "9644") AND status="401" OR status="403"🔗 References
- https://github.com/redpanda-data/redpanda/compare/v23.1.20...v23.1.21
- https://github.com/redpanda-data/redpanda/compare/v23.2.17...v23.2.18
- https://github.com/redpanda-data/redpanda/issues/15048
- https://github.com/redpanda-data/redpanda/pull/14969
- https://github.com/redpanda-data/redpanda/pull/15060
- https://github.com/redpanda-data/redpanda/compare/v23.1.20...v23.1.21
- https://github.com/redpanda-data/redpanda/compare/v23.2.17...v23.2.18
- https://github.com/redpanda-data/redpanda/issues/15048
- https://github.com/redpanda-data/redpanda/pull/14969
- https://github.com/redpanda-data/redpanda/pull/15060
