CVE-2024-27317: Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification

Should you act?

High exploit likelihood

EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

• No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
• EPSS 56.9%, percentile 99: FIRST’s model estimates a 56.9% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
• Needs an account (low (any account)). Exposure depends on who can log in.
• Only applies if your dependency tree includes org.apache.pulsar:pulsar-functions-worker (Maven) >= 2.4.0, < 2.10.6, fixed in 2.10.6; org.apache.pulsar:pulsar-functions-worker (Maven) >= 2.11.0, < 2.11.4, fixed in 2.11.4; org.apache.pulsar:pulsar-functions-worker (Maven) >= 3.0.0, < 3.0.3, fixed in 3.0.3; org.apache.pulsar:pulsar-functions-worker (Maven) >= 3.1.0, < 3.1.3, fixed in 3.1.3. Check your lockfile, including transitive dependencies.

What it is

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

From the GitHub advisory

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true".

This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0.

2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1.

Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.

Weakness type: CWE-22.

Product: org.apache.pulsar:pulsar-functions-worker (Maven) · Assigned by: apache · Published: 2024-03-12

Affected and fixed versions

Severity scores

• Attack vector: network (remotely reachable)
• Attack complexity: high (needs special conditions)
• Privileges required: low (any account)
• User interaction: none
• Scope: changed (can affect other components)

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

• CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• FIRST EPSS (model of 2026-10-21): 56.93% probability of exploitation activity in the next 30 days; percentile 99.

Timeline

• 2024-03-12 — CVE record published by apache
• 2024-03-12 — GitHub-reviewed advisory GHSA-jg2g-4rjg-cmqh published (critical)
• 2025-02-13 — CVE record last updated

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.

Vendor and project advisories, patches

1. pulsar.apache.org pulsar.apache.org

Vulnerability records

1. GitHub Advisory GHSA-jg2g-4rjg-cmqh github.com
2. CVE.org record CVE-2024-27317 cve.org
3. NVD entry CVE-2024-27317 nvd.nist.gov

Other references from the CVE record and advisory

1. lists.apache.org lists.apache.org
2. openwall.com openwall.com

Critical Maven advisories · Today’s Security Digest