CVE-2023-44981: Apache ZooKeeper: Authorization bypass in SASL Quorum Peer Authentication
Apache ZooKeeper could allow a remote attacker to bypass security restrictions, caused by a flaw when SASL Quorum Peer authentication is enabled. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass authorization and allow arbitrary endpoints to join the cluster and begin propagating counterfeit changes.
Other sources
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve@EXAMPLE.COM', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue. Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue. See the documentation for more details on correct cluster administration.
— Ubuntu
Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization is done by verifying that the instance part in SASL authentication ID is listed in zoo.cfg server list. The instance part in SASL auth ID is optional and if it's missing, like 'eve', the authorization check will be skipped. As a result an arbitrary endpoint could join the cluster and begin propagating counterfeit changes to the leader, essentially giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default.
Users are recommended to upgrade to version 3.9.1, 3.8.3, 3.7.2, which fixes the issue.
Alternately ensure the ensemble election/quorum communication is protected by a firewall as this will mitigate the issue.
See the documentation for more details on correct cluster administration.
https://lists.apache.org/thread/wf0yrk84dg1942z1o74kd8nycg6pgm5b http://www.openwall.com/lists/oss-security/2023/10/11/4
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-44981?
CVE-2023-44981 is a vulnerability in Apache ZooKeeper that allows authorization bypass through user-controlled key.
What is the severity of CVE-2023-44981?
The severity of CVE-2023-44981 is critical with a CVSS score of 9.1.
How does CVE-2023-44981 affect Apache ZooKeeper?
CVE-2023-44981 affects Apache ZooKeeper by enabling an authorization bypass in SASL Quorum Peer Authentication.
Which versions of Apache ZooKeeper are affected by CVE-2023-44981?
CVE-2023-44981 affects Apache ZooKeeper versions 3.9.0 to 3.9.1, 3.8.0 to 3.8.3, and 3.7.2.
How can I fix CVE-2023-44981?
To fix CVE-2023-44981, update Apache ZooKeeper to version 3.9.1, 3.8.3, or 3.7.2.