CVE-2023-51437
📋 TL;DR
This vulnerability allows attackers to forge SASL Role Tokens that pass signature verification due to timing discrepancies in Apache Pulsar's authentication provider. Attackers could potentially gain unauthorized access to Pulsar clusters. All Apache Pulsar deployments using SASL Authentication Provider are affected.
💻 Affected Systems
- Apache Pulsar Broker
- Apache Pulsar Proxy
- Apache Pulsar Websocket Proxy
- Apache Pulsar Function Worker
📦 What is this software?
Pulsar by Apache
Pulsar by Apache
Pulsar by Apache
Pulsar by Apache
Pulsar by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Pulsar cluster allowing unauthorized data access, message injection, and administrative control
Likely Case
Unauthorized access to Pulsar topics and functions, potentially leading to data exposure or service disruption
If Mitigated
Limited impact with proper network segmentation and monitoring, but authentication bypass still possible
🎯 Exploit Status
Timing attacks require multiple authentication attempts and network proximity to measure response times accurately
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.11.3, 3.0.2, or 3.1.1
Vendor Advisory: https://lists.apache.org/thread/5kgmvvolf5tzp5rz9xjwfg2ncwvqqgl5
Restart Required: Yes
Instructions:
1. Stop Pulsar services. 2. Backup configuration and data. 3. Upgrade to patched version. 4. Update saslJaasServerRoleTokenSignerSecretPath secret. 5. Restart services.
🔧 Temporary Workarounds
Network isolation
linuxRestrict network access to Pulsar SASL authentication endpoints
iptables -A INPUT -p tcp --dport 6650 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 6650 -j DROP
Disable SASL authentication
allTemporarily disable SASL authentication if alternative authentication methods are available
Set authenticationEnabled=false in broker.conf
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach Pulsar authentication endpoints
- Enable detailed authentication logging and monitor for unusual authentication patterns
🔍 How to Verify
Check if Vulnerable:
Check Pulsar version and if SASL authentication is enabled in configuration filesCheck Version:
pulsar-admin brokers version or check Pulsar startup logsVerify Fix Applied:
Verify version is 2.11.3+, 3.0.2+, or 3.1.1+ and test SASL authentication functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed SASL authentication attempts from single source
- Unusual timing patterns in authentication logs
Network Indicators:
- High volume of authentication requests to Pulsar ports
- Traffic patterns suggesting timing measurement
SIEM Query:
source="pulsar.log" AND ("authentication failed" OR "SASL") | stats count by src_ip