CVE-2024-27894: 
Java vulnerability analysis and mitigation

CVE-2024-27894 affects the Pulsar Functions Worker component in Apache Pulsar, discovered in March 2024. The vulnerability exists in the functionality that allows authenticated users to create functions using URL-referenced implementations (supporting file, http, and https schemes). This vulnerability affects Apache Pulsar versions from 2.4.0 to 2.10.5, 2.11.0 to 2.11.3, 3.0.0 to 3.0.2, 3.1.0 to 3.1.2, and 3.2.0. The issue was discovered by Lari Hotari of StreamNative (Pulsar Security).

The vulnerability stems from improper input validation in the URL-based function implementation feature. When a function is created using this method, the Functions Worker retrieves the implementation from the user-provided URL without proper restrictions. The vulnerability has received a CVSS v3.1 Base Score of 8.8 HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) from NVD, while Apache Software Foundation rated it with a Base Score of 8.5 HIGH (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) (NVD Details).

The vulnerability allows attackers to gain unauthorized access to any file that the Pulsar Functions Worker process has permissions to read, including sensitive information such as secrets in the process environment. Additionally, attackers could use the Functions Worker as a proxy to access content from remote HTTP and HTTPS endpoints, potentially enabling denial of service attacks. This vulnerability also affects the Pulsar Broker when configured with 'functionsWorkerEnabled=true' (OSS Security).

The vulnerability requires authentication and can be exploited by an attacker with access to create functions in the Pulsar Functions Worker. The attack vector is network-accessible, with low attack complexity and no user interaction required, as indicated by the CVSS metrics (NVD Details).

Users are advised to upgrade to patched versions: 2.10.6 or later for 2.10.x users, 2.11.4 or later for 2.11.x users, 3.0.3 or later for 3.0.x users, 3.1.3 or later for 3.1.x users, and 3.2.1 or later for 3.2.x users. The updated versions impose restrictions on function creation using URLs by default. For users who require URL-based function creation, two configuration keys are provided: 'additionalEnabledConnectorUrlPatterns' and 'additionalEnabledFunctionsUrlPatterns' to specify permitted URL patterns (Pulsar Security).