CVE-2018-8012

Vulnerability

Apache ZooKeeper before version 3.4.10, and versions 3.5.0-alpha through 3.5.3-beta, do not enforce authentication or authorization when a server attempts to join a quorum. This allows an arbitrary endpoint to join the cluster by simply connecting to the quorum port [1].

Exploitation

An attacker with network access to the ZooKeeper ensemble can initiate a quorum join request. No prior authentication, credentials, or special privileges are required. The attacker sends a crafted join request to become part of the quorum [1].

Impact

Once joined, the attacker can propagate counterfeit changes to the leader, potentially corrupting the cluster state, causing data inconsistencies, or leading to a denial of service. This can compromise the integrity and availability of the ZooKeeper service [1].

Mitigation

Upgrade to ZooKeeper 3.4.10 or later, or 3.5.3-beta or later. If an immediate upgrade is not possible, restrict network access to the quorum ports (default 2888 and 3888) using firewalls to limit exposure to trusted networks only [1].