CVE-2024-51504

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-51504", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-10-28T21:45:25.587Z", "datePublished": "2024-11-07T09:52:03.957Z", "dateUpdated": "2024-11-07T16:33:08.247Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.zookeeper:zookeeper", "product": "Apache ZooKeeper", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.9.3", "status": "affected", "version": "3.9.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "4ra1n"}, {"lang": "en", "type": "reporter", "value": "Y4tacker"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue."}], "value": "When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in\u00a0IPAuthenticationProvider, which uses HTTP request headers, is weak\u00a0and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-11-07T09:52:03.957Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/11/06/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-11-07T10:03:24.899Z"}}, {"affected": [{"vendor": "apache", "product": "zookeeper", "cpes": ["cpe:2.3:a:apache:zookeeper:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "3.9.0", "status": "affected", "lessThan": "3.9.3", "versionType": "semver"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-11-07T16:31:39.548543Z", "id": "CVE-2024-51504", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T16:33:08.247Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-51504", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2024-10-28T21:45:25.587Z", "datePublished": "2024-11-07T09:52:03.957Z", "dateUpdated": "2024-11-07T16:33:08.247Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.zookeeper:zookeeper", "product": "Apache ZooKeeper", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.9.3", "status": "affected", "version": "3.9.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "reporter", "value": "4ra1n"}, {"lang": "en", "type": "reporter", "value": "Y4tacker"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue."}], "value": "When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in\u00a0IPAuthenticationProvider, which uses HTTP request headers, is weak\u00a0and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue."}], "metrics": [{"other": {"content": {"text": "important"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290 Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2024-11-07T09:52:03.957Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh"}], "source": {"discovery": "UNKNOWN"}, "title": "Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2024/11/06/5"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-11-07T10:03:24.899Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-51504", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-11-07T16:31:39.548543Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:zookeeper:-:*:*:*:*:*:*:*"], "vendor": "apache", "product": "zookeeper", "versions": [{"status": "affected", "version": "3.9.0", "lessThan": "3.9.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-07T16:33:01.001Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected", "packageName": "org.apache.zookeeper:zookeeper", "product": "Apache ZooKeeper", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.9.3", "status": "affected", "version": "3.9.0", "versionType": "semver"}]}], "source": "security@apache.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:apache:zookeeper:-:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "zookeeper", "vendor": "apache", "versions": [{"lessThan": "3.9.3", "status": "affected", "version": "3.9.0", "versionType": "semver"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:zookeeper:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6D94E88-B99B-4610-9DDB-4F16EEB88392", "versionEndExcluding": "3.9.3", "versionStartIncluding": "3.9.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in\u00a0IPAuthenticationProvider, which uses HTTP request headers, is weak\u00a0and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue."}, {"lang": "es", "value": "Al utilizar IPAuthenticationProvider en el servidor de administraci\u00f3n de ZooKeeper, existe la posibilidad de omisi\u00f3n de autenticaci\u00f3n por suplantaci\u00f3n; esto solo afecta a la autenticaci\u00f3n basada en IP implementada en el servidor de administraci\u00f3n de ZooKeeper. La configuraci\u00f3n predeterminada de la detecci\u00f3n de la direcci\u00f3n IP del cliente en IPAuthenticationProvider, que utiliza encabezados de solicitud HTTP, es d\u00e9bil y permite a un atacante omitir la autenticaci\u00f3n mediante la suplantaci\u00f3n de la direcci\u00f3n IP del cliente en los encabezados de solicitud. La configuraci\u00f3n predeterminada respeta el encabezado HTTP X-Forwarded-For para leer la direcci\u00f3n IP del cliente. El encabezado de solicitud X-Forwarded-For es utilizado principalmente por servidores proxy para identificar al cliente y puede ser f\u00e1cilmente suplantado por un atacante que pretenda que la solicitud proviene de una direcci\u00f3n IP diferente. Los comandos del servidor de administraci\u00f3n, como instant\u00e1nea y restauraci\u00f3n, se pueden ejecutar arbitrariamente en caso de explotaci\u00f3n exitosa, lo que podr\u00eda provocar fugas de informaci\u00f3n o problemas de disponibilidad del servicio. Se recomienda a los usuarios que actualicen a la versi\u00f3n 3.9.3, que soluciona este problema."}], "id": "CVE-2024-51504", "lastModified": "2026-06-17T08:05:49.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-51504", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-11-07T16:31:39.548543Z", "version": "2.0.3"}}]}, "published": "2024-11-07T10:15:08.297", "references": [{"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2024/11/06/5"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.zookeeper: Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server", "id": "2324330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2324330"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-290", "details": ["When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only impacts IP based authentication implemented in ZooKeeper Admin Server. Default configuration of client's IP address detection in\u00a0IPAuthenticationProvider, which uses HTTP request headers, is weak\u00a0and allows an attacker to bypass authentication via spoofing client's IP address in request headers. Default configuration honors X-Forwarded-For HTTP header to read client's IP address. X-Forwarded-For request header is mainly used by proxy servers to identify the client and can be easily spoofed by an attacker pretending that the request comes from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily can be executed on successful exploitation which could potentially lead to information leakage or service availability issues. Users are recommended to upgrade to version 3.9.3, which fixes this issue.", "An authentication bypass vulnerability was found in Apache Zookeeper. The default configuration of the client's IP address detection in IPAuthenticationProvider, which uses HTTP request headers, is weak and allows an attacker to bypass authentication by spoofing the client's IP address in request headers. The default configuration honors the X-Forwarded-For HTTP header to read the client's IP address, which can be easily spoofed by an attacker pretending that the request came from a different IP address. Admin Server commands, such as snapshot and restore arbitrarily, can be executed on successful exploitation, potentially leading to information leakage or service availability issues."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-51504", "package_state": [{"cpe": "cpe:/a:redhat:a_mq_clients:2", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "A-MQ Clients 2"}, {"cpe": "cpe:/a:redhat:logging:5", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Logging Subsystem for Red Hat OpenShift"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:3", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat build of Apache Camel for Spring Boot 3"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:debezium:2", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat build of Debezium 2"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:integration:1", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat Integration Camel K 1"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:7", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "Red Hat JBoss Data Grid 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Not affected", "package_name": "zookeeper", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Not affected", "package_name": "zookeeper", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Not affected", "package_name": "zookeeper", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:amq_streams:1", "fix_state": "Not affected", "package_name": "org.apache.zookeeper/zookeeper", "product_name": "streams for Apache Kafka"}], "public_date": "2024-11-07T09:52:03Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-51504\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-51504\nhttps://lists.apache.org/thread/b3qrmpkto5r6989qr61fw9y2x646kqlh"], "statement": "This vulnerability is considered an Important severity because it allows an attacker to bypass authentication by spoofing the client\u2019s IP address, exploiting a weakness in ZooKeeper Admin Server's reliance on the `X-Forwarded-For` HTTP header for IP-based authentication. Unlike moderate vulnerabilities that might require additional conditions for exploitation, this flaw directly exposes critical admin commands\u2014such as snapshot and restore\u2014without requiring complex attack vectors. Successful exploitation can lead to unauthorized execution of sensitive commands, resulting in potential information leakage, data integrity risks, and service availability issues.", "threat_severity": "Important"}

{}