Directory Traversal Vulnerability in Apache Pulsar Functions Worker Could Allow Attacker to Modify Files Outside of Designated Extraction Directory

CVE-2024-27317

Summary

In the Apache Pulsar Functions Worker, authenticated users have the ability to upload functions using jar or nar files. These files are processed by the Functions Worker, which extracts their content. A vulnerability exists due to inadequate validation of filenames within the zip files, potentially allowing special path elements like '..' to be included. This oversight leads to a directory traversal vulnerability, where an attacker could craft a malicious upload that modifies or creates files in directories outside of the intended extraction path. Importantly, this vulnerability also impacts the Pulsar Broker when it is configured with the 'functionsWorkerEnabled=true' setting. Users operating on vulnerable versions are strongly advised to upgrade to the secure releases listed in the advisory to mitigate these risks.

References