Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials

CVE-2023-37579 is an incorrect authorization vulnerability in the Apache Pulsar Function Worker, affecting versions before 2.10.4 and 2.11.0 [1][2]. The root cause is that the Function Worker fails to enforce proper authorization checks when an authenticated user requests the configuration of a source or a sink. Because many source and sink configurations contain sensitive credentials (e.g., for connecting to external systems), this flaw can lead to credential disclosure [2].

Exploitation requires the attacker to be an authenticated user of the Pulsar cluster. The attacker must also know the exact name of the target source or sink, as there is no known method for an authenticated user to enumerate another tenant's sources or sinks [2]. The attack does not require any special privileges, only that the user can send an API request to retrieve the configuration of a known source or sink belonging to another tenant [1].

A successful attacker can retrieve the full configuration of a source or sink, including any embedded credentials [2]. This could lead to unauthorized access to external systems that the source or sink connects to, such as databases, message queues, or cloud services. The impact is primarily credential exposure, which may enable lateral movement or data theft depending on the privileges of the leaked credentials.

Apache has released patched versions: 2.10.4 and 2.11.1, which fix the authorization check [2]. Users running version 2.9.* or earlier are advised to upgrade to one of these patched releases. Pulsar 3.0 is unaffected [2]. There is no known workaround other than upgrading. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog.