CVE-2023-44981: Apache ZooKeeper Auth Bypass Vulnerability

CVE-2023-44981 Overview

CVE-2023-44981 is an Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. When SASL Quorum Peer authentication is enabled in ZooKeeper (quorum.auth.enableSasl=true), the authorization mechanism verifies that the instance part in the SASL authentication ID is listed in the zoo.cfg server list. However, the instance part in the SASL auth ID is optional, and if it's missing (for example, eve@EXAMPLE.COM), the authorization check will be completely skipped. This flaw allows an arbitrary endpoint to join the cluster and begin propagating counterfeit changes to the leader, essentially granting complete read-write access to the data tree.

Critical Impact

An attacker can bypass authentication and join a ZooKeeper cluster as an unauthorized peer, gaining complete read-write access to the entire data tree and the ability to propagate malicious changes across the distributed system.

Affected Products

• Apache ZooKeeper versions prior to 3.9.1, 3.8.3, and 3.7.2
• Debian Linux 10.0, 11.0, and 12.0
• Any system with SASL Quorum Peer authentication enabled (quorum.auth.enableSasl=true)

Discovery Timeline

• 2023-10-11 - CVE-2023-44981 published to NVD
• 2025-04-23 - Last updated in NVD database

Technical Details for CVE-2023-44981

Vulnerability Analysis

This vulnerability exists in the SASL Quorum Peer authentication mechanism of Apache ZooKeeper. ZooKeeper uses SASL (Simple Authentication and Security Layer) for authenticating peers in a cluster when the quorum.auth.enableSasl configuration is set to true. The authentication process is designed to verify that connecting peers are legitimate members of the cluster by checking their SASL authentication ID against the server list defined in zoo.cfg.

The flaw lies in how ZooKeeper parses and validates the SASL authentication ID. A properly formatted SASL ID should contain an instance part that identifies the specific server (e.g., zookeeper/host1@EXAMPLE.COM). However, the instance part is treated as optional by the authentication code. When an attacker presents a SASL ID without the instance part (e.g., eve@EXAMPLE.COM), the authorization validation is bypassed entirely.

This allows an unauthenticated attacker to join the ZooKeeper ensemble as a rogue peer. Once joined, the malicious peer can propagate counterfeit data changes to the leader node, effectively compromising the integrity and confidentiality of the entire distributed data tree. This is particularly dangerous in production environments where ZooKeeper is used for critical coordination services like Apache Kafka, Hadoop, and other distributed systems.

Root Cause

The root cause is an improper authorization check in the SASL Quorum Peer authentication logic. The code fails to properly handle cases where the instance part of the SASL authentication ID is missing. Instead of rejecting authentication attempts without a valid instance part, the system incorrectly skips the authorization check entirely, treating the missing instance as a valid condition. This represents a classic CWE-639 (Authorization Bypass Through User-Controlled Key) vulnerability where user-controlled input (the SASL ID format) directly influences the authorization decision.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker must have network access to the ZooKeeper cluster's quorum communication ports (typically port 2888 for peer communication and 3888 for leader election). The attack sequence involves:

1. The attacker identifies a ZooKeeper cluster with SASL Quorum Peer authentication enabled
2. The attacker crafts a SASL authentication request with a principal that lacks the instance part (e.g., attacker@REALM instead of zookeeper/hostname@REALM)
3. ZooKeeper's authentication handler processes the request and skips the server list validation due to the missing instance
4. The malicious peer successfully joins the cluster ensemble
5. The attacker can now propagate counterfeit changes to the leader, gaining complete read-write access to the data tree

Note that Quorum Peer authentication is not enabled by default, which limits the attack surface to clusters that have explicitly enabled this feature.

Detection Methods for CVE-2023-44981

Indicators of Compromise

• Unexpected new peers appearing in ZooKeeper cluster membership logs
• SASL authentication events with principals lacking instance parts (e.g., user@REALM without /hostname)
• Suspicious data modifications in the ZooKeeper data tree without corresponding legitimate client requests
• Anomalous network connections to quorum ports (2888/3888) from unauthorized IP addresses

Detection Strategies

• Monitor ZooKeeper server logs for SASL authentication attempts with malformed or missing instance parts in the principal
• Implement network monitoring to detect unauthorized connections to ZooKeeper quorum ports from outside the expected peer IP ranges
• Deploy intrusion detection rules that alert on new peer join events that don't match the configured server list
• Audit ZooKeeper data tree changes and correlate with legitimate client activity to identify unauthorized modifications

Monitoring Recommendations

• Enable detailed SASL authentication logging in ZooKeeper configuration
• Configure network-level monitoring for ZooKeeper quorum communication ports (2888, 3888)
• Implement SentinelOne's network detection capabilities to identify unauthorized peer connection attempts
• Set up alerts for any changes to cluster membership that don't align with planned maintenance activities

How to Mitigate CVE-2023-44981

Immediate Actions Required

• Upgrade Apache ZooKeeper to version 3.9.1, 3.8.3, or 3.7.2 depending on your deployment branch
• If immediate patching is not possible, ensure the ensemble election/quorum communication is protected by a firewall
• Audit current cluster membership and remove any unauthorized peers
• Review SASL authentication logs for evidence of exploitation attempts

Patch Information

Apache has released patched versions that address this authorization bypass vulnerability. Users should upgrade to one of the following fixed versions:

• Apache ZooKeeper 3.9.1 for the 3.9.x branch
• Apache ZooKeeper 3.8.3 for the 3.8.x branch
• Apache ZooKeeper 3.7.2 for the 3.7.x branch

For detailed patch information and upgrade instructions, refer to the Apache Mailing List Notification. Debian users should also review Debian Security Advisory DSA-5544 and the Debian LTS Announcement for distribution-specific guidance.

Workarounds

• Implement strict firewall rules to restrict access to ZooKeeper quorum ports (2888, 3888) to only known, authorized peer IP addresses
• Use network segmentation to isolate ZooKeeper cluster communication from untrusted networks
• If SASL Quorum Peer authentication is not strictly required, consider disabling it (quorum.auth.enableSasl=false) until patching can be completed
• Deploy network-level authentication such as mutual TLS for an additional layer of protection on quorum communication

# Firewall configuration example to restrict quorum ports
# Allow only authorized ZooKeeper peers to communicate on quorum ports
iptables -A INPUT -p tcp --dport 2888 -s 10.0.1.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 2888 -s 10.0.1.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 2888 -s 10.0.1.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 3888 -s 10.0.1.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 3888 -s 10.0.1.11 -j ACCEPT
iptables -A INPUT -p tcp --dport 3888 -s 10.0.1.12 -j ACCEPT
iptables -A INPUT -p tcp --dport 2888 -j DROP
iptables -A INPUT -p tcp --dport 3888 -j DROP