CVE-2024-27894

Summary

CVE-2024-27894: A vulnerability in the Apache Pulsar Functions Worker and Broker allows authenticated users to create functions using URLs, introducing a risk of unauthorized file access. This issue enables attackers to read any file the Pulsar Functions Worker process can access, potentially revealing sensitive information such as secrets. Moreover, an attacker could use this vulnerability as a proxy to access remote HTTP and HTTPS endpoints, leading to denial of service attacks. Versions 2.10.5 and earlier, 2.11.3 and earlier, 3.0.2 and earlier, 3.1.2 and earlier, and 3.2.0 are affected. Users should upgrade to 2.10.6, 2.11.4, 3.0.3, 3.1.3, and 3.2.1, respectively, or the latest patched versions. The updated versions impose restrictions on URL-based function creation but allow configuring permitted URL patterns.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.