CVE-2024-27894: Apache Pulsar Information Disclosure Flaw

CVE-2024-27894 Overview

Apache Pulsar Functions Worker contains an input validation flaw [CWE-20] that allows authenticated users to abuse the URL-based function creation feature. The worker accepts file, http, and https URL schemes when fetching function implementations. Attackers can exploit this to read arbitrary local files, exfiltrate process environment variables and secrets, or use the worker as a proxy to reach internal HTTP endpoints. The flaw also enables denial-of-service conditions and extends to Apache Pulsar Broker when functionsWorkerEnabled=true is configured.

Critical Impact
Authenticated attackers can read arbitrary files accessible to the Pulsar process, harvest environment secrets, and pivot to internal network resources via server-side request forgery.

Affected Products

Apache Pulsar 2.4.0 through 2.10.5
Apache Pulsar 2.11.0 through 2.11.3
Apache Pulsar 3.0.0 through 3.0.2, 3.1.0 through 3.1.2, and 3.2.0

Discovery Timeline

2024-03-12 - CVE-2024-27894 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-27894

Vulnerability Analysis

Apache Pulsar Functions Worker exposes an API that lets authenticated users register functions by supplying a URL pointing to the function implementation. The worker fetches this URL server-side without restricting the scheme or destination. An authenticated user with function-creation privileges can supply a file:// URI to read any file the worker process can access on disk. This includes configuration files, TLS keys, cloud credential files, and /proc/self/environ, which exposes environment variables often containing API tokens and database passwords.

By supplying http:// or https:// URLs, attackers turn the worker into an outbound proxy. This enables server-side request forgery (SSRF) against internal services, cloud metadata endpoints, and other network resources the worker can reach. Repeated large fetches can also exhaust worker resources, producing denial-of-service conditions.

Root Cause

The root cause is the absence of URL scheme and destination validation on the function creation code path. The worker treats user-supplied URLs as trusted and delegates retrieval to the standard URL loader.

Attack Vector

Exploitation requires network access to the Pulsar Functions API and valid credentials with function-creation permissions. The attacker submits a function-creation request with a crafted URL parameter. The worker retrieves and processes the referenced content, exposing local files or proxying network requests on the attacker's behalf. Full technical details are available in the Apache Pulsar CVE-2024-27894 advisory.

Detection Methods for CVE-2024-27894

Indicators of Compromise

Function-creation API calls containing file://, http://, or https:// URLs in the implementation parameter
Outbound HTTP requests from the Pulsar Functions Worker process to unexpected internal or external hosts
Function definitions referencing sensitive local paths such as /etc/, /proc/self/environ, or cloud credential directories

Detection Strategies

Audit Pulsar admin API logs for POST requests to function creation endpoints and inspect the URL fields for non-allowlisted schemes or hosts
Monitor process-level file reads by the Pulsar Functions Worker against sensitive filesystem locations
Correlate function creation events with subsequent egress network connections from the worker host

Monitoring Recommendations

Enable verbose audit logging on the Pulsar admin interface and forward logs to a centralized analytics platform
Baseline normal outbound destinations for the Functions Worker and alert on deviations
Track authentication events for accounts holding function-management roles and flag creations from unusual source IPs

How to Mitigate CVE-2024-27894

Immediate Actions Required

Upgrade to a patched Apache Pulsar version matching your release line before restoring URL-based function creation
Restrict function-creation permissions to the minimum set of trusted service accounts
Review recent function definitions for suspicious URL references and revoke any created by untrusted users

Patch Information

Upgrade Apache Pulsar Functions Worker to a fixed release: 2.10.6 or later for the 2.10 line, 2.11.4 or later for 2.11, 3.0.3 or later for 3.0, 3.1.3 or later for 3.1, and 3.2.1 or later for 3.2. Patched versions restrict URL-based function creation by default. Operators who require URL-based creation can allowlist patterns using the additionalEnabledConnectorUrlPatterns and additionalEnabledFunctionsUrlPatterns configuration keys. See the Apache Pulsar security advisory and the Apache mailing list announcement for full details.

Workarounds

Disable the Functions Worker on Pulsar Brokers by setting functionsWorkerEnabled=false where functions are not required
Place the Functions Worker behind a network policy that blocks outbound access to internal management networks and cloud metadata services
Enforce least-privilege authorization on the Pulsar admin API so only vetted principals can create functions

bash

# Configuration example: restrict URL patterns after upgrade
additionalEnabledConnectorUrlPatterns=["https://artifacts.internal.example.com/.*"]
additionalEnabledFunctionsUrlPatterns=["https://artifacts.internal.example.com/.*"]