Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy

Vulnerability

Description

Incorrect authorization vulnerability in Apache Pulsar Function Worker occurs when a client connects via the Pulsar Proxy. When the proxy uses mTLS authentication with the Function Worker, the worker improperly uses the proxy's role for authorization instead of the client's actual role. This flaw affects Pulsar versions before 2.10.4 and 2.11.0 [2].

Exploitation

An attacker can exploit this by connecting to the Function Worker through the Pulsar Proxy configured with mTLS. The proxy authenticates to the worker, and the worker mistakenly inherits the proxy's privileges. If the proxy is assigned a superuser role, the client obtains unauthorized elevated permissions. No additional authentication bypass is needed beyond accessing the system via the proxy [2].

Impact

Successful exploitation leads to privilege escalation, allowing an attacker to perform actions beyond their intended authorization. This could include executing functions, accessing sensitive data, or performing administrative operations that the client should not be permitted [2].

Mitigation

The recommended mitigation is to upgrade the Pulsar Function Worker to patched versions: 2.10.4 or later, or 2.11.1 or later. Users on 2.9.* or earlier should upgrade to one of these versions. Pulsar 3.0 is unaffected [2]. The Apache Pulsar project provides the fix in the official repository [1].