When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper’s audit log by sending a digest authentication request with tab characters (t) embedded in the username. Because the audit log uses tab-separated\u00a0key=value\u00a0format, the injected tabs are parsed as legitimate field separators, allowing the attacker to spoof audit results (e.g., injecting\u00a0result=success), forge operation types, and corrupt forensic evidence.<\/p>\n
A log injection vulnerability in Apache ZooKeeper allows a client that can call\u00a0setACL\u00a0to inject forged key-value fields into\u00a0zookeeper_audit.log. When audit logging is enabled, the server serializes attacker-controlled digest ACL ids into the\u00a0acl=\u00a0audit field without escaping tab characters. Because audit events are emitted as tab-separated\u00a0key=value\u00a0records, a crafted ACL id can make one successful\u00a0setAcl\u00a0event appear to contain forged fields such as\u00a0operation=delete\u00a0and\u00a0znode=\/forged. This undermines the integrity of downstream audit parsing, alerting, and incident response.<\/p>\n
This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6.<\/p>\n
Users are recommended to upgrade to version 3.9.6 or 3.8.7, which fixes the issue.<\/p>\n","protected":false},"excerpt":{"rendered":"
When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper’s audit log by sending a digest authentication request with t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24469","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}