CVE-2024-51504
📋 TL;DR
This vulnerability allows attackers to bypass IP-based authentication in ZooKeeper Admin Server by spoofing the X-Forwarded-For HTTP header. It affects systems using ZooKeeper Admin Server with default IP authentication configuration. Successful exploitation enables unauthorized execution of admin commands like snapshot and restore operations.
💻 Affected Systems
- Apache ZooKeeper
📦 What is this software?
Zookeeper by Apache
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ZooKeeper service allowing data manipulation, information leakage, and service disruption through unauthorized admin command execution.
Likely Case
Unauthorized access to admin functions leading to data exposure or service availability issues.
If Mitigated
Limited impact if proper network segmentation and authentication controls are implemented.
🎯 Exploit Status
Exploitation requires sending HTTP requests with spoofed X-Forwarded-For headers to Admin Server endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.3
Vendor Advisory: https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh
Restart Required: Yes
Instructions:
1. Download ZooKeeper 3.9.3 from Apache website. 2. Stop ZooKeeper service. 3. Backup configuration files. 4. Install new version. 5. Restore configuration. 6. Restart ZooKeeper service.
🔧 Temporary Workarounds
Disable IPAuthenticationProvider
allRemove or disable IP-based authentication in ZooKeeper Admin Server configuration
Edit zoo.cfg and remove or comment out authProvider.1=org.apache.zookeeper.server.auth.IPAuthenticationProvider
Network Restriction
linuxRestrict access to ZooKeeper Admin Server endpoints using firewall rules
iptables -A INPUT -p tcp --dport 8080 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit Admin Server access to trusted IPs only
- Use alternative authentication mechanisms instead of IP-based authentication
🔍 How to Verify
Check if Vulnerable:
Check ZooKeeper version and configuration for IPAuthenticationProvider usage with default settingsCheck Version:
echo stat | nc localhost 2181 | grep VersionVerify Fix Applied:
Verify ZooKeeper version is 3.9.3 or later and test authentication bypass attempts fail📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to Admin Server endpoints
- Unexpected X-Forwarded-For header values in requests
Network Indicators:
- HTTP requests to Admin Server ports (default 8080) with spoofed headers
- Unusual admin command execution patterns
SIEM Query:
source="zookeeper.log" AND ("IPAuthenticationProvider" OR "X-Forwarded-For") AND ("failed" OR "unauthorized")