TI-2024-18500 Aliases CVE-2024-27894 GHSA-c2x9-vw5h-39vc

Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying

MEDIUM 42CWE-20Published 2024-03-12 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-552.

Summary

The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will retrieve the implementation from the URL provided by the user. However, this feature introduces a vulnerability that can be exploited by an attacker to gain unauthorized access to any file that the Pulsar Functions Worker process has permissions to read. This includes reading the process environment which potentially includes sensitive information, such as secrets. Furthermore, an attacker could leverage this vulnerability to use the Pulsar Functions Worker as a proxy to access the content of remote HTTP and HTTPS endpoint URLs. This could also be used to carry out denial of service attacks. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions. The updated versions of Pulsar Functions Worker will, by default, impose restrictions on the creation of functions using URLs. For users who rely on this functionality, the Function Worker configuration provides two configuration keys: "additionalEnabledConnectorUrlPatterns" and "additionalEnabledFunctionsUrlPatterns". These keys allow users to specify a set of URL patterns that are permitted, enabling the creation of functions using URLs that match the defined patterns. This approach ensures that the feature remains available to those who require it, while limiting the potential for unauthorized access and exploitation.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01895 79th percentileScored 2026-11-07

Fix Fixed Apache Pulsar (Apache Software Foundation): 2.10.6, 2.11.4, 3.0.3 +2org.apache.pulsar:pulsar-functions-worker (Maven): 2.10.6, 2.11.4, 3.0.3 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Pulsar	2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.1	2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1	Patch available	CNA
—	org.apache.pulsar:pulsar-functions-worker (Maven)	2.4.0 to before 2.10.6	2.10.6	Patch available	GHSA-c2x9-vw5h-39vc
—	org.apache.pulsar:pulsar-functions-worker (Maven)	2.11.0 to before 2.11.4	2.11.4	Patch available	GHSA-c2x9-vw5h-39vc
—	org.apache.pulsar:pulsar-functions-worker (Maven)	3.0.0 to before 3.0.3	3.0.3	Patch available	GHSA-c2x9-vw5h-39vc
—	org.apache.pulsar:pulsar-functions-worker (Maven)	3.1.0 to before 3.1.3	3.1.3	Patch available	GHSA-c2x9-vw5h-39vc
—	org.apache.pulsar:pulsar-functions-worker (Maven)	3.2.0 to before 3.2.1	3.2.1	Patch available	GHSA-c2x9-vw5h-39vc

Apache Pulsar VendorApache Affected 2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3; 3.2.0 to before 3.2.1 Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1 Patch available CNA
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.4.0 to before 2.10.6 Fixed in 2.10.6 Patch available GHSA-c2x9-vw5h-39vc
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 2.11.0 to before 2.11.4 Fixed in 2.11.4 Patch available GHSA-c2x9-vw5h-39vc
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.0.0 to before 3.0.3 Fixed in 3.0.3 Patch available GHSA-c2x9-vw5h-39vc
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.1.0 to before 3.1.3 Fixed in 3.1.3 Patch available GHSA-c2x9-vw5h-39vc
org.apache.pulsar:pulsar-functions-worker (Maven) Vendor— Affected 3.2.0 to before 3.2.1 Fixed in 3.2.1 Patch available GHSA-c2x9-vw5h-39vc

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:pulsar::::::::	2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3	Vulnerable	Apache
cpe:2.3:a:apache:pulsar:3.2.0:-::::::	3.2.0	Vulnerable	Apache

cpe:2.3:a:apache:pulsar:*:*:*:*:*:*:*:* Versions 2.4.0 to before 2.10.6; 2.11.0 to before 2.11.4; 3.0.0 to before 3.0.3; 3.1.0 to before 3.1.3 Vulnerable ·Apache
cpe:2.3:a:apache:pulsar:3.2.0:-:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Apache

Remediation

Fix · CNA Apache Pulsar (Apache Software Foundation) Fixed in 2.10.6, 2.11.4, 3.0.3, 3.1.3, 3.2.1
Fix · GHSA-c2x9-vw5h-39vc org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.10.6 Advisory →
Fix · GHSA-c2x9-vw5h-39vc org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 2.11.4 Advisory →
Fix · GHSA-c2x9-vw5h-39vc org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.0.3 Advisory →
Fix · GHSA-c2x9-vw5h-39vc org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.1.3 Advisory →
Fix · GHSA-c2x9-vw5h-39vc org.apache.pulsar:pulsar-functions-worker (Maven) Fixed in 3.2.1 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-03-12
Apache Pulsar 2.10.6, 2.11.4 and 3 more versions
4 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File ModificationPriority HIGH 76
- TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code ExecutionPriority MEDIUM 52
- TI-2024-18679 Apache Pulsar: Improper Authorization For Topic-Level Policy ManagementPriority LOW 32
Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 5 products

Red Hat Fuse 7
Red Hat Integration Camel K 1
Red Hat JBoss Enterprise Application Platform 8
Red Hat build of Apache Camel for Spring Boot 3
Red Hat build of Apache Camel for Spring Boot 4

Timeline

2026-10-02 Threatist record created from CVE-2024-27894
2026-10-03 Alias added: GHSA-c2x9-vw5h-39vc

References

Advisory 4

Other 2

TI-2024-18155 Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification CVSS 3.1CRITICAL 9.9
TI-2021-05150 Authentication with JWT allows use of “none”-algorithm CVSS 3.1CRITICAL 9.8
TI-2024-17990 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVSS 3.1CRITICAL 9.9
TI-2023-14272 Apache Pulsar: Incorrect Authorization for Function Worker when using mTLS Authentication through Pulsar Proxy CVSS 3.1CRITICAL 9.6
TI-2022-15232 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint CVSS 3.1HIGH 8.2
TI-2023-19177 Apache Pulsar Function Worker: Incorrect Authorization for Function Worker Can Leak Sink/Source Credentials CVSS 3.1HIGH 8.2

See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences