Pulsar Functions Worker Vulnerability: Unauthorized Access and Proxy Attacks

CVE-2024-27894

Summary

The Apache Pulsar Functions Worker has a vulnerability that enables authenticated users to create functions that reference implementations hosted at a URL. This includes 'file', 'http', and 'https' schemes. When a function is created in this manner, the Functions Worker retrieves executable code from the provided URL. This feature can be exploited by attackers to gain unauthorized access to files permissible by the Pulsar Functions Worker process, potentially exposing sensitive information like secrets from the process environment. Additionally, attackers could exploit this vulnerability to use the Functions Worker as a proxy, accessing external HTTP and HTTPS endpoints or executing denial of service attacks. The Pulsar Broker is equally affected when configured with 'functionsWorkerEnabled=true'. Users are strongly advised to update to patched versions to mitigate this risk.

References