High severity · published Dec 20, 2023
CVE-2023-37544
Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.
This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.
The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.
2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5.
2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2.
3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1.
3.1 Pulsar WebSocket Proxy users are unaffected.
Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
Pulsar · Apache
before 2.10.5; 2.11.0 before 2.11.2; 3.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-37544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-37544
Mailing List
http://www.openwall.com/lists/oss-security/2023/12/20/2
Mailing List
https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m
More from Pulsar
9.9
CVE-2024-27317
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files
9.9
CVE-2024-27135
Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the…
9.8
CVE-2021-22160
If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented…
8.8
CVE-2024-27894
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL
8.8
CVE-2023-30429
Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar