Listen to this Post
The vulnerability exists within the AdminServer component of Apache ZooKeeper. AdminServer provides an HTTP interface for administrative commands, including creating snapshots and restoring from them. The flaw is an improper authorization check. When an authenticated client sends a request to the `/snapshot` or `/restore` endpoint, the server fails to correctly verify if the client possesses the necessary administrative permissions (specifically, the `ADMIN` permission) before executing the command. This means a client with only basic, non-admin authentication could trigger a full system snapshot or a potentially destructive restore operation. The vulnerability stems from a missing or incorrect permission validation step in the command handler code path, allowing authorized but non-privileged users to perform critical state-management actions, compromising data integrity and availability.
Platform: Apache ZooKeeper
Version: 3.9.0 to 3.9.3
Vulnerability: Improper Authorization
Severity: Moderate
date: 2024-09-24
Prediction: Patch expected 2024-09-27
What Undercode Say:
curl -X POST http://zk-server:8080/commands/snapshot`./zkServer.sh snapshotForgery
<h2 style="color: blue;"></h2>if (!hasAdminPermission(client)) { // Bypassed check }`
<h2 style="color: blue;">
How Exploit:
Attacker sends POST request to AdminServer snapshot/restore endpoints without sufficient ADMIN rights, triggering unauthorized data dump or overwrite.
Protection from this CVE
Upgrade to ZooKeeper version 3.9.4. Disable snapshot/restore commands via `admin.snapshot.enabled=false` and `admin.restore.enabled=false` in configuration. Alternatively, disable the entire AdminServer with `admin.enableServer=false` if not required.
Impact:
Unauthorized users can create snapshots, exposing sensitive configuration data. Malicious restore operations can corrupt the ZooKeeper data tree, leading to service disruption and data loss for dependent applications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
