Apache Pulsar Broker: Incorrect Authorization Validation for Rest Producer

CVE-2023-30428

Summary

An incorrect authorization vulnerability in the Apache Pulsar Broker's Rest Producer allows an authenticated user to produce messages to any topic by leveraging a custom HTTP header. This exploitation can have severe consequences, including the generation of unwanted messages across the cluster and the potential manipulation of topic-level policies, thereby affecting message handling and security for other tenants. The vulnerability is only exploitable when an attacker has direct access to the Pulsar Broker, while connections through the Pulsar Proxy are not impacted. Users operating affected versions are urged to upgrade to the latest patched releases to mitigate risks.

References