Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Improper Authorization vulnerability in Apache ZooKeeper.

When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking it against the principal the client authenticated as. The server then tries to replace the requested identity with a canonical form of the authenticated principal, derived from the zookeeper.security.auth_to_local rules. If no rule applies to the principal, canonicalization fails and the error is only logged. The client-requested authzid then becomes the session's SASL identity for all ACL checks.

An authenticated client whose principal is not covered by the auth_to_local rules can therefore claim any SASL identity. With the default rules, this includes any Kerberos principal from a realm other than the server's default realm, such as a principal from a cross-realm trusted realm. The client then gets the permissions granted to that identity in sasl ACLs. If the requested identity matches a configured zookeeper.superUser, it gets superuser access to the whole data tree.

Users are recommended to upgrade to version 3.8.8 or 3.9.7, which fixes the issue.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• lists.apache.org/thread.html/81rdyqlmlp3dtkkqgp8t5080g3b9r2pj Üretici bülteni
• openwall.com/lists/oss-security/2026/11/03/10 Diğer

Kayıt geçmişi

1. 4 Kas 2026 13:44Yayımlandı

İlgili açıklar

• 7,1 CVE-2026-100302Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling
• 8,7 CVE-2026-115448Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable
• 8,7 CVE-2026-100300Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread
• 6,0 CVE-2026-100235Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
• 6,3 CVE-2026-118516Symfony: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control
• 8,8 CVE-2026-120554Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save