Disabled Hostname Verification makes Brokers, Proxies vulnerable to MITM attack

Vulnerability

Overview

The TLS hostname verification feature cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar Proxy's Admin Client [1]. This leaves intra-cluster connections and geo-replication connections vulnerable to man-in-the-middle (MITM) attacks. The vulnerability affects Apache Pulsar Broker, Proxy, and WebSocket Proxy versions 2.7.0 to 2.7.4, 2.8.0 to 2.8.3, 2.9.0 to 2.9.2, 2.10.0, and 2.6.4 and earlier [1].

Exploitation

Conditions

An attacker must control a machine positioned between the client and the server, then actively manipulate traffic by presenting a cryptographically valid certificate for an unrelated host [1]. The vulnerability applies to both the pulsar+ssl protocol and HTTPS [1].

Impact

Successful exploitation could leak credentials, configuration data, message data, and any other data sent by these clients [1].

Mitigation

As of the publication date, the vulnerability is inherent in the affected versions because hostname verification cannot be enabled [1]. Users should restrict network access to trusted hosts, monitor for updates from Apache, and plan to upgrade to a version that implements hostname verification once available.