Read the docs
TI-2024-18155 Aliases CVE-2024-27317GHSA-jg2g-4rjg-cmqh

Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

Priority HIGH 76CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.56934 99th percentileScored 2026-11-07
Fix Partial Apache Pulsar (Apache Software Foundation): 2.10.6, 2.11.4, 3.0.3 +2org.apache.pulsar:pulsar-functions-worker (Maven): 2.10.6, 2.11.4, 3.0.3 +2Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Pulsar2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.12.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1Patch availableCNA
—org.apache.pulsar:pulsar-functions-worker (Maven)2.4.0 to before 2.10.62.10.6Patch availableGHSA-jg2g-4rjg-cmqh
—org.apache.pulsar:pulsar-functions-worker (Maven)2.11.0 to before 2.11.42.11.4Patch availableGHSA-jg2g-4rjg-cmqh
—org.apache.pulsar:pulsar-functions-worker (Maven)3.0.0 to before 3.0.33.0.3Patch availableGHSA-jg2g-4rjg-cmqh
—org.apache.pulsar:pulsar-functions-worker (Maven)3.1.0 to before 3.1.33.1.3Patch availableGHSA-jg2g-4rjg-cmqh
—org.apache.pulsar:pulsar-functions-worker (Maven)3.2.0 to before 3.2.13.2.1Patch availableGHSA-jg2g-4rjg-cmqh
  • Apache Pulsar VendorApache Affected 2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.1 Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1 Patch available CNA
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.4.0 to before 2.10.6 Fixed in 2.10.6 Patch available GHSA-jg2g-4rjg-cmqh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.11.0 to before 2.11.4 Fixed in 2.11.4 Patch available GHSA-jg2g-4rjg-cmqh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-jg2g-4rjg-cmqh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.1.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-jg2g-4rjg-cmqh
  • org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-jg2g-4rjg-cmqh

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:*2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3VulnerableApache
cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:*3.2.0VulnerableApache
  • cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1
  • Fix · GHSA-jg2g-4rjg-cmqh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.10.6 Advisory →
  • Fix · GHSA-jg2g-4rjg-cmqh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.11.4 Advisory →
  • Fix · GHSA-jg2g-4rjg-cmqh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.0.3 Advisory →
  • Fix · GHSA-jg2g-4rjg-cmqh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-jg2g-4rjg-cmqh org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.2.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Apache Pulsar 2.10.6, 2.11.4 and 3 more versions

    4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionPriority MEDIUM 52
    • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS ProxyingPriority MEDIUM 42
    • TI-2024-18679 Apache Pulsar: Improper Authorization For Topic-Level Policy ManagementPriority LOW 32
    Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Will not fix
Not affected: 4 products
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-27317
  2. 2026-10-03 Alias added: GHSA-jg2g-4rjg-cmqh

References

Advisory 4

Other 2

  • TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
  • TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
  • TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
  • TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
  • TI-2024-18500 Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying CVSS 3.1HIGH 8.8
  • TI-2023-19177 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials CVSS 3.1HIGH 8.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences