CVE-2025-58457
📋 TL;DR
This vulnerability allows authorized ZooKeeper clients to execute snapshot and restore commands without proper permission checks. It affects Apache ZooKeeper installations running versions 3.9.0 through 3.9.3. The issue enables privilege escalation within the ZooKeeper administrative interface.
💻 Affected Systems
- Apache ZooKeeper
📦 What is this software?
Zookeeper by Apache
⚠️ Risk & Real-World Impact
Worst Case
Authorized clients could execute administrative snapshot/restore operations, potentially disrupting ZooKeeper cluster operations or restoring malicious data.
Likely Case
Authorized users with limited permissions could perform administrative operations they shouldn't have access to, violating the principle of least privilege.
If Mitigated
With proper ACLs or AdminServer disabled, the vulnerability has minimal impact as unauthorized access is prevented.
🎯 Exploit Status
Requires authorized client access. Exploitation involves sending specific commands to the AdminServer interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.4
Vendor Advisory: https://lists.apache.org/thread/r5yol0kkhx2fzw22pxk1ozwm3oc6yxrx
Restart Required: No
Instructions:
1. Download ZooKeeper 3.9.4 from Apache website. 2. Stop ZooKeeper service. 3. Replace existing installation with 3.9.4. 4. Start ZooKeeper service. 5. Verify version is now 3.9.4.
🔧 Temporary Workarounds
Disable AdminServer
allCompletely disable the AdminServer interface
Set admin.enableServer=false in zoo.cfg
Disable vulnerable commands
allDisable only the snapshot and restore commands
Set admin.snapshot.enabled=false and admin.restore.enabled=false in zoo.cfg
Restrict ACL permissions
allEnsure root ACL does not provide open permissions
Configure appropriate ACLs for root node using ZooKeeper ACL commands
🧯 If You Can't Patch
- Disable AdminServer interface completely via admin.enableServer=false
- Disable snapshot and restore commands via admin.snapshot.enabled=false and admin.restore.enabled=false
- Implement strict network access controls to limit AdminServer access
- Review and tighten ZooKeeper ACL configurations
🔍 How to Verify
Check if Vulnerable:
Check ZooKeeper version and verify if running 3.9.0-3.9.3 with AdminServer enabledCheck Version:
echo stat | nc localhost 2181 | grep VersionVerify Fix Applied:
Verify ZooKeeper version is 3.9.4 or later, or that mitigation controls are properly configured📡 Detection & Monitoring
Log Indicators:
- Unauthorized snapshot/restore command attempts in ZooKeeper logs
- AdminServer access logs showing suspicious commands
Network Indicators:
- Unexpected traffic to AdminServer port (typically 8080)
- Snapshot/restore commands from unauthorized sources
SIEM Query:
source="zookeeper.log" AND ("snapshot" OR "restore") AND NOT user="authorized_user"