Pulsar Admin API allows access to data from other tenants using getMessageById API

Vulnerability

In Apache Pulsar versions 2.8.0 and prior, 2.7.3 and prior, and 2.6.4 and prior, the Admin API get-message-by-id endpoint accepts a topic and a ledger ID. Authorization checks are performed only on the topic name, but the ledger ID is not validated to ensure it belongs to that topic. This allows a user to specify a ledger ID from another tenant's data, bypassing access controls [2].

Exploitation

An attacker must have authenticated access to the Pulsar Admin API and know a valid ledger ID from another tenant. The attacker sends a request to get-message-by-id with a topic they have access to and a ledger ID that points to data owned by a different tenant. The server does not verify that the ledger ID is associated with the given topic, so it returns the message from the foreign ledger [2].

Impact

Successful exploitation leads to unauthorized reading of messages stored in BookKeeper ledgers that belong to other tenants. This results in information disclosure, potentially exposing sensitive data. The attacker gains access to data they are not authorized to view, violating multi-tenant isolation [2].

Mitigation

The issue is fixed in Apache Pulsar versions 2.8.1, 2.7.4, and 2.6.5 [1][3]. Users should upgrade to these versions or later. The fix adds validation to ensure the ledger ID corresponds to the requested topic [3]. No workaround is available for unpatched versions.