Apache Pulsar Proxy target broker address isn't validated

CVE-2022-24280 is an improper input validation vulnerability in the Proxy component of Apache Pulsar. The Proxy does not adequately validate target broker addresses when proxying connections, allowing an attacker to make TCP/IP connection attempts originating from the Pulsar Proxy's IP address [1][2][3].

To exploit this vulnerability, an attacker must have a valid token to a properly secured Pulsar Proxy [2][3]. With authenticated access, the attacker can attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to, effectively using the proxy as a relay [2][3].

The primary impact of this flaw is enabling denial-of-service (DoS) attacks that appear to originate from the Pulsar Proxy's IP address, potentially masking the attacker's true location [2][3]. However, Apache has stated that the Proxy authentication itself cannot be bypassed through this vulnerability [2][3].

Mitigation involves upgrading to patched versions (2.7.5+, 2.8.3+, 2.9.2+) and applying configuration changes to restrict proxied broker connections to known addresses and ports (6650, 6651) using the brokerProxyAllowedHostNames and brokerProxyAllowedIPAddresses settings [3].