Vulnerability record · CVE-2024-27317 · published 12 March 2024
CVE-2024-27317: Apache Pulsar Functions Worker zip extraction path traversal
Apache · Pulsar
Authenticated users can upload function jar or nar files to the Pulsar Functions Worker, which extracts them as zip archives without validating filenames. Crafted entries containing ".." allow writing or modifying files outside the intended extraction directory, and the same flaw applies to the Pulsar Broker when functionsWorkerEnabled=true.
Description
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Automated analysis
high priorityCritical CVSS (9.9) with scope change and high EPSS, but exploitation requires an authenticated account and no KEV or public exploit is documented.
What it is
Authenticated users can upload function jar or nar files to the Pulsar Functions Worker, which extracts them as zip archives without validating filenames. Crafted entries containing ".." allow writing or modifying files outside the intended extraction directory, and the same flaw applies to the Pulsar Broker when functionsWorkerEnabled=true.
Impact
An attacker with a valid account can create or overwrite arbitrary files on the host, which can alter system behavior and, given the scope change and high confidentiality, integrity and availability ratings, may lead to broader compromise of the Pulsar deployment.
Attack surface
Reached over the network through the function upload interface of the Functions Worker or a Broker with functionsWorkerEnabled=true. Authentication is required (PR:L) and no user interaction is needed (UI:N).
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.56934 (99th percentile), indicating elevated near-term exploitation likelihood.
What to do
- Upgrade to the patched release for your branch: 2.10.6, 2.11.4, 3.0.3, 3.1.3 or 3.2.1, or newer.
- If immediate upgrade is not possible, restrict who can upload functions and disable functionsWorkerEnabled on Brokers that do not need it.
- Run the Functions Worker under a dedicated low-privilege account with a confined filesystem view so traversal writes cannot reach sensitive paths.
- Audit and remove unnecessary write permissions on directories adjacent to the function extraction path.
Detection
- Monitor function upload events and correlate with unexpected file creation or modification outside the extraction directory.
- Alert on zip or nar entries containing ".." or absolute paths in uploaded function artifacts.
- Watch for new or changed files in Pulsar host directories that are not part of normal deployment activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.openwall.com/lists/oss-security/2024/03/12/10 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/ct9xmvlf7lompc1pxvlsb60qstfsm9po | Vendor Advisory |
| https://pulsar.apache.org/security/CVE-2024-27317/ | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2024/03/12/10 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/ct9xmvlf7lompc1pxvlsb60qstfsm9po | Vendor Advisory |
| https://pulsar.apache.org/security/CVE-2024-27317/ | Vendor Advisory |
Track CVE-2024-27317 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2024-27317), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
