Apache Pulsar: Broker does not always disconnect client when authentication data expires

Vulnerability

Overview

CVE-2023-31007 is an Improper Authentication vulnerability in Apache Pulsar Broker. The flaw allows a client to remain connected to a broker after its authentication data expires. This occurs when the broker is configured with authenticateOriginalAuthData=false and the client connects through the Pulsar Proxy, or when a client connects directly using a specially crafted connect command under the same configuration [1][2].

Exploitation

Conditions

Exploitation requires a specific broker configuration (authenticateOriginalAuthData=false). This setting is typically used in deployments where the Pulsar Proxy handles initial authentication, but the broker does not re-verify the client's credentials after the proxy session. An attacker who initially authenticates (or gains access via a valid credential) can then send a crafted connect command to bypass subsequent authentication checks, maintaining a persistent connection [2].

Impact

An attacker exploiting this vulnerability can maintain unauthorized access to a Pulsar broker beyond the token's expiration period. This could lead to continued message production or consumption, access to sensitive data, or other broker operations without proper authorization, compromising the security of the messaging system [1][2].

Mitigation

Apache Pulsar has released patched versions: 2.9.5, 2.10.4, and 2.11.1. Users of versions through 2.9.4, 2.10.0 through 2.10.3, and 2.11.0 should upgrade immediately. Version 3.0 and later are unaffected. Administrators should also review their configuration of authenticateOriginalAuthData to ensure alignment with security requirements [2].