Vulnerability-Lookup

CNVD-2021-70104

Vulnerability from cnvd - Published: 2021-09-11

Title

Apache Pulsar数据伪造问题漏洞

Description

Apache Pulsar是美国阿帕奇（Apache）基金会的一个用于云环境种，集消息、存储、轻量化函数式计算为一体的分布式消息流平台。该软件支持多租户、持久化存储、多机房跨区域数据复制，具有强一致性、高吞吐以及低延时的高可扩展流数据存储特性。 Apache Pulsar存在数据伪造问题漏洞，该漏洞源于在处理基于JSON Web令牌(JWT)的身份验证请求时出现的错误，远程攻击者可利用该漏洞绕过身份验证过程。

Severity

高

Patch Name

Apache Pulsar数据伪造问题漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://www.cybersecurity-help.cz/vdb/SB2021052540

Reference

https://nvd.nist.gov/vuln/detail/CVE-2021-22160

Impacted products

Name
Apache Pulsar <2.7.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-22160",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-22160"
    }
  },
  "description": "Apache Pulsar\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u7528\u4e8e\u4e91\u73af\u5883\u79cd\uff0c\u96c6\u6d88\u606f\u3001\u5b58\u50a8\u3001\u8f7b\u91cf\u5316\u51fd\u6570\u5f0f\u8ba1\u7b97\u4e3a\u4e00\u4f53\u7684\u5206\u5e03\u5f0f\u6d88\u606f\u6d41\u5e73\u53f0\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u591a\u79df\u6237\u3001\u6301\u4e45\u5316\u5b58\u50a8\u3001\u591a\u673a\u623f\u8de8\u533a\u57df\u6570\u636e\u590d\u5236\uff0c\u5177\u6709\u5f3a\u4e00\u81f4\u6027\u3001\u9ad8\u541e\u5410\u4ee5\u53ca\u4f4e\u5ef6\u65f6\u7684\u9ad8\u53ef\u6269\u5c55\u6d41\u6570\u636e\u5b58\u50a8\u7279\u6027\u3002\n\nApache Pulsar\u5b58\u5728\u6570\u636e\u4f2a\u9020\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u5904\u7406\u57fa\u4e8eJSON Web\u4ee4\u724c(JWT)\u7684\u8eab\u4efd\u9a8c\u8bc1\u8bf7\u6c42\u65f6\u51fa\u73b0\u7684\u9519\u8bef\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u8fc7\u7a0b\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.cybersecurity-help.cz/vdb/SB2021052540",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-70104",
  "openTime": "2021-09-11",
  "patchDescription": "Apache Pulsar\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u57fa\u91d1\u4f1a\u7684\u4e00\u4e2a\u7528\u4e8e\u4e91\u73af\u5883\u79cd\uff0c\u96c6\u6d88\u606f\u3001\u5b58\u50a8\u3001\u8f7b\u91cf\u5316\u51fd\u6570\u5f0f\u8ba1\u7b97\u4e3a\u4e00\u4f53\u7684\u5206\u5e03\u5f0f\u6d88\u606f\u6d41\u5e73\u53f0\u3002\u8be5\u8f6f\u4ef6\u652f\u6301\u591a\u79df\u6237\u3001\u6301\u4e45\u5316\u5b58\u50a8\u3001\u591a\u673a\u623f\u8de8\u533a\u57df\u6570\u636e\u590d\u5236\uff0c\u5177\u6709\u5f3a\u4e00\u81f4\u6027\u3001\u9ad8\u541e\u5410\u4ee5\u53ca\u4f4e\u5ef6\u65f6\u7684\u9ad8\u53ef\u6269\u5c55\u6d41\u6570\u636e\u5b58\u50a8\u7279\u6027\u3002\r\n\r\nApache Pulsar\u5b58\u5728\u6570\u636e\u4f2a\u9020\u95ee\u9898\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u5904\u7406\u57fa\u4e8eJSON Web\u4ee4\u724c(JWT)\u7684\u8eab\u4efd\u9a8c\u8bc1\u8bf7\u6c42\u65f6\u51fa\u73b0\u7684\u9519\u8bef\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u8fc7\u7a0b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Apache Pulsar\u6570\u636e\u4f2a\u9020\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Apache Pulsar \u003c2.7.1"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-22160",
  "serverity": "\u9ad8",
  "submitTime": "2021-05-26",
  "title": "Apache Pulsar\u6570\u636e\u4f2a\u9020\u95ee\u9898\u6f0f\u6d1e"
}

CVE-2021-22160 (GCVE-0-2021-22160)

Vulnerability from cvelistv5 – Published: 2021-05-26 12:22 – Updated: 2024-08-03 18:37

Title

Authentication with JWT allows use of “none”-algorithm

Summary

If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to "none". This allows an attacker to connect to Pulsar instances as any user (incl. admins).

Severity

No CVSS data available.

CWE

token not validated

Assigner

apache mitre root

References

8 references

URL	Tags
https://lists.apache.org/thread.html/r347650d15a3…	x_refsource_MISC
https://lists.apache.org/thread.html/rf2e90942996…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ra49cb621051…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/ra49cb621051…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r8e545559781…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/r9a12b4da2f2…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rbe845aa1573…	mailing-listx_refsource_MLIST
https://lists.apache.org/thread.html/rca54f4b26ba…	mailing-listx_refsource_MLIST

Impacted products

1 product

Vendor	Product	Version
Apache Software Foundation	Apache Pulsar	Affected: Apache Pulsar , < 2.7.1 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:37:18.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-dev] 20210527 Cutting 2.6.4 release to address CVE-2021-22160",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf2e90942996dceebac8296abf39257cfeb5ae918f82f7af3d37a48c5%40%3Cdev.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-dev] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \"none\"-algorithm",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cdev.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-users] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \"none\"-algorithm",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cusers.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-dev] 20210527 Re: Cutting 2.6.4 release to address CVE-2021-22160",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da%40%3Cdev.pulsar.apache.org%3E"
          },
          {
            "name": "Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \u201cnone\u201d-algorithm",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-dev] 20210531 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rbe845aa1573a61769b9c5916c62971f4b10de87c2ea5f38a97f0cf84%40%3Cdev.pulsar.apache.org%3E"
          },
          {
            "name": "[pulsar-dev] 20210604 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rca54f4b26ba5e6f2e39732b47ec51640e89f57e3b6a38ac3bab314df%40%3Cdev.pulsar.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Apache Pulsar",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.7.1",
              "status": "affected",
              "version": "Apache Pulsar",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to \"none\". This allows an attacker to connect to Pulsar instances as any user (incl. admins)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "token not validated",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-04T20:06:14.000Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-dev] 20210527 Cutting 2.6.4 release to address CVE-2021-22160",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf2e90942996dceebac8296abf39257cfeb5ae918f82f7af3d37a48c5%40%3Cdev.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-dev] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \"none\"-algorithm",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cdev.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-users] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \"none\"-algorithm",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550%40%3Cusers.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-dev] 20210527 Re: Cutting 2.6.4 release to address CVE-2021-22160",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da%40%3Cdev.pulsar.apache.org%3E"
        },
        {
          "name": "Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \u201cnone\u201d-algorithm",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-dev] 20210531 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rbe845aa1573a61769b9c5916c62971f4b10de87c2ea5f38a97f0cf84%40%3Cdev.pulsar.apache.org%3E"
        },
        {
          "name": "[pulsar-dev] 20210604 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rca54f4b26ba5e6f2e39732b47ec51640e89f57e3b6a38ac3bab314df%40%3Cdev.pulsar.apache.org%3E"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Authentication with JWT allows use of \u201cnone\u201d-algorithm",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "ID": "CVE-2021-22160",
          "STATE": "PUBLIC",
          "TITLE": "Authentication with JWT allows use of \u201cnone\u201d-algorithm"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Pulsar",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "Apache Pulsar",
                            "version_value": "2.7.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "If Apache Pulsar is configured to authenticate clients using tokens based on JSON Web Tokens (JWT), the signature of the token is not validated if the algorithm of the presented token is set to \"none\". This allows an attacker to connect to Pulsar instances as any user (incl. admins)."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "token not validated"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E",
              "refsource": "MISC",
              "url": "https://lists.apache.org/thread.html/r347650d15a3e9c5f58b83e918b6ad6dedc2a63d3eb63da8e6a7be87e%40%3Cusers.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-dev] 20210527 Cutting 2.6.4 release to address CVE-2021-22160",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf2e90942996dceebac8296abf39257cfeb5ae918f82f7af3d37a48c5@%3Cdev.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-dev] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \"none\"-algorithm",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550@%3Cdev.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-users] 20210527 Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \"none\"-algorithm",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/ra49cb62105154e4795b259c79a6b27d63bfa2ab5787ff8529b089550@%3Cusers.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-dev] 20210527 Re: Cutting 2.6.4 release to address CVE-2021-22160",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r8e545559781231a83bf0644548c660255859e52feb86bbfcd42590da@%3Cdev.pulsar.apache.org%3E"
            },
            {
              "name": "Re: [SECURITY] [CVE-2021-22160] Authentication with JWT allows use of \u201cnone\u201d-algorithm",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r9a12b4da2f26ce9b8f7e7117a879efaa973dab7e54717bbc7923fab1%40%3Cdev.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-dev] 20210531 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rbe845aa1573a61769b9c5916c62971f4b10de87c2ea5f38a97f0cf84@%3Cdev.pulsar.apache.org%3E"
            },
            {
              "name": "[pulsar-dev] 20210604 Re: [DISCUSS] Propose More Formal Policy for Security Patches and EOL of Versions",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rca54f4b26ba5e6f2e39732b47ec51640e89f57e3b6a38ac3bab314df@%3Cdev.pulsar.apache.org%3E"
            }
          ]
        },
        "source": {
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2021-22160",
    "datePublished": "2021-05-26T12:22:31.000Z",
    "dateReserved": "2021-01-05T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:37:18.090Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.