VYPR
← All advisories
High severityNVD Advisory· Published Feb 7, 2024· Updated Aug 2, 2024

Apache Pulsar: Timing attack in SASL token signature verification

CVE-2023-51437

Description

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider updating the configured secret in the saslJaasServerRoleTokenSignerSecretPath file.

Any component matching an above version running the SASL Authentication Provider is affected. That includes the Pulsar Broker, Proxy, Websocket Proxy, or Function Worker.

2.11 Pulsar users should upgrade to at least 2.11.3. 3.0 Pulsar users should upgrade to at least 3.0.2. 3.1 Pulsar users should upgrade to at least 3.1.1. Any users running Pulsar 2.8, 2.9, 2.10, and earlier should upgrade to one of the above patched versions.

For additional details on this attack vector, please refer to https://codahale.com/a-lesson-in-timing-attacks/ .

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Apache Pulsar's SASL authentication provider contains a timing side-channel that lets an attacker forge role tokens and bypass signature verification.

Vulnerability

CVE-2023-51437 is an observable timing discrepancy vulnerability in Apache Pulsar's SASL Authentication Provider [2]. The SASL token signature verification process takes measurably different amounts of time depending on how many bytes of the expected signature match, which constitutes a classic timing side-channel [3]. This allows an attacker to iteratively forge a valid SASL Role Token by observing response times and adjusting the guess byte by byte [2][3].

Exploitation

The attacker does not need any prior authentication; the attack is performed remotely against any exposed SASL-authenticated endpoint (Pulsar Broker, Proxy, Websocket Proxy, or Function Worker) [2]. The only prerequisite is network access to a service that uses the SASL Authentication Provider and that accepts role tokens for verification [3]. By sending many token candidates and measuring the verification latency, the attacker can deduce the correct signature and forge a token that will pass all checks [1][3].

Impact

Successful exploitation allows an unauthenticated attacker to impersonate any Pulsar role (e.g., a superuser or tenant admin) and gain all the associated privileges on the cluster [2][3]. This includes publishing and consuming messages, modifying topic configurations, managing subscriptions, and performing administrative operations—effectively full control over the targeted Pulsar deployment [1].

Mitigation

Apache has released fixed versions: 2.11.3, 3.0.2, and 3.1.1 [2][3]. Users are strongly advised to upgrade immediately and also rotate the secret stored in the saslJaasServerRoleTokenSignerSecretPath file to invalidate any previously forged tokens [2][3]. Versions 2.8 through 2.10 and earlier are end-of-life and must migrate to a patched release [2].

References
  1. GitHub - apache/pulsar: Apache Pulsar - distributed pub-sub messaging system
  2. NVD - CVE-2023-51437
  3. security - CVE-2023-51437: Apache Pulsar: Timing attack in SASL token signature verification

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.pulsar:pulsar-broker-auth-saslMaven
< 2.11.32.11.3
org.apache.pulsar:pulsar-broker-auth-saslMaven
>= 3.0.0, < 3.0.23.0.2
org.apache.pulsar:pulsar-broker-auth-saslMaven
>= 3.1.0, < 3.1.13.1.1

Affected products

2

Patches

4
6274fa01a75d

[fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)

https://github.com/apache/pulsarYiheng CaoAug 24, 2023via ghsa
commit
1 file changed · +1 −1
  • pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java+1 −1 modified
    @@ -76,7 +76,7 @@ public String verifyAndExtract(String signedStr) throws AuthenticationException
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;
bc1019fa8ed3

[fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)

https://github.com/apache/pulsarYiheng CaoAug 24, 2023via ghsa
commit
1 file changed · +1 −1
  • pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java+1 −1 modified
    @@ -76,7 +76,7 @@ public String verifyAndExtract(String signedStr) throws AuthenticationException
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;
c05954e66ff3

[fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)

https://github.com/apache/pulsarYiheng CaoAug 24, 2023via ghsa
commit
1 file changed · +1 −1
  • pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java+1 −1 modified
    @@ -76,7 +76,7 @@ public String verifyAndExtract(String signedStr) throws AuthenticationException
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;
c27beca64cc9

[fix][broker] Use MessageDigest.isEqual when comparing digests (#21061)

https://github.com/apache/pulsarYiheng CaoAug 24, 2023via ghsa
commit
1 file changed · +1 −1
  • pulsar-broker-auth-sasl/src/main/java/org/apache/pulsar/broker/authentication/SaslRoleTokenSigner.java+1 −1 modified
    @@ -76,7 +76,7 @@ public String verifyAndExtract(String signedStr) throws AuthenticationException
         String originalSignature = signedStr.substring(index + SIGNATURE.length());
         String rawValue = signedStr.substring(0, index);
         String currentSignature = computeSignature(rawValue);
-        if (!originalSignature.equals(currentSignature)) {
+        if (!MessageDigest.isEqual(originalSignature.getBytes(), currentSignature.getBytes())){
             throw new AuthenticationException("Invalid signature");
         }
         return rawValue;

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.