Directory Traversal Vulnerability in Apache Pulsar Functions Worker Could Allow Attacker to Modify Files Outside of Designated Extraction Directory

CVE-2024-27317

What is CVE-2024-27317?

In the Apache Pulsar Functions Worker, authenticated users have the ability to upload functions using jar or nar files. These files are processed by the Functions Worker, which extracts their content. A vulnerability exists due to inadequate validation of filenames within the zip files, potentially allowing special path elements like '..' to be included. This oversight leads to a directory traversal vulnerability, where an attacker could craft a malicious upload that modifies or creates files in directories outside of the intended extraction path. Importantly, this vulnerability also impacts the Pulsar Broker when it is configured with the 'functionsWorkerEnabled=true' setting. Users operating on vulnerable versions are strongly advised to upgrade to the secure releases listed in the advisory to mitigate these risks.

References