Improper Authentication Vulnerability in Apache Pulsar Proxy Could Lead to Sensitive Information Exposure and Denial of Service

CVE-2022-34321

Summary

An improper authentication vulnerability in the Apache Pulsar Proxy can allow attackers to access the /proxy-stats endpoint without proper credentials. This exposed endpoint reveals sensitive statistics about active connections and enables unauthorized changes to the logging levels for proxied connections. The vulnerability poses risks such as revealing client IP addresses and potentially enabling denial-of-service conditions through increased logging overhead. Notably, when deployed within Kubernetes, original client IPs might be obscured due to default load balancer configurations. Users are advised to upgrade to specified patched versions and ensure the Apache Pulsar Proxy is not directly exposed to the internet, as it is designed to function in secured network environments.

References