CVE-2023-37544 - Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

Back Back to CVE browser

HIGH

Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

Published Dec 20, 2023

7.5

HIGH

CVSS 3.1

EPSS 1.35%

Description

Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication.

This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2.10.0 through 2.10.4, from 2.11.0 through 2.11.1, 3.0.0.

The known risks include a denial of service due to the WebSocket Proxy accepting any connections, and excessive data transfer due to misuse of the WebSocket ping/pong feature.

2.10 Pulsar WebSocket Proxy users should upgrade to at least 2.10.5. 2.11 Pulsar WebSocket Proxy users should upgrade to at least 2.11.2. 3.0 Pulsar WebSocket Proxy users should upgrade to at least 3.0.1. 3.1 Pulsar WebSocket Proxy users are unaffected. Any users running the Pulsar WebSocket Proxy for 2.8, 2.9, and earlier should upgrade to one of the above patched versions.

Affected products

Vendor Apache Software Foundation Product Apache Pulsar WebSocket Proxy Default
unaffected
- Version
  2.10.0
  Status
  affected
  Constraints
  <=2.10.4
- Version
  2.11.0
  Status
  affected
  Constraints
  <=2.11.1
- Version
  2.8.0
  Status
  affected
  Constraints
  <=2.8.*
- Version
  2.9.0
  Status
  affected
  Constraints
  <=2.9.*
- Version
  3.0.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Apache Software Foundation

Apache Pulsar WebSocket Proxy

unaffected

Version	Status	Constraints
2.10.0	affected	<=2.10.4
2.11.0	affected	<=2.11.1
2.8.0	affected	<=2.8.*
2.9.0	affected	<=2.9.*
3.0.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (8)

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2023/12/20/2		Mailing List
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-3156		Advisory
https://github.com/advisories/GHSA-83q5-whqp-r8jr		Advisory
https://github.com/apache/pulsar/commit/11ee36d0351644a006d2a8639bdcc714fb602358
https://github.com/apache/pulsar/commit/894192fb6542e504be43034a3c33e90f9c6e528a
https://github.com/apache/pulsar/commit/eac263e8f2a93d3b9f707b97c7bbcbc2a826569f
https://lists.apache.org/thread/od0k9zts1toc9h9snbqq4pjpyx28mv4m		vendor-advisoryMailing List
https://nvd.nist.gov/vuln/detail/CVE-2023-37544