Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack

Vulnerability

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. This flaw affects all versions from 2.7.0 to 2.10.0 and earlier, as listed in the advisory [1].

Exploitation

An attacker must gain control of a machine positioned between the client and server (man-in-the-middle) and actively manipulate traffic to exploit this vulnerability. The attacker does not need credentials but must have network access to the communication path [1].

Impact

Successful exploitation can leak authentication data, configuration data, and any other data sent by the Admin Client over intra-cluster and geo-replication HTTPS connections [1].

Mitigation

As of the advisory, no fix is mentioned. Users should upgrade to a patched version once available or apply workarounds such as segmenting network access to limit man-in-the-middle opportunities [1].