Damien Diederen

**Name of the Vulnerable Software and Affected Versions** Apache ZooKeeper versions 3.9.0 through 3.9.3 **Description** An improper permission check exists in the ZooKeeper AdminServer, allowing authorized clients to execute snapshot and restore commands with insufficient permissions. The issue can be mitigated by disabling the snapshot and restore commands via `admin.snapshot.enabled` and `admin.restore.enabled`, disabling the entire AdminServer interface via `admin.enableServer`, or ensuring the root Access Control List (ACL) does not provide open permissions. ZooKeeper ACLs are not recursive, meaning this does not impact operations on child nodes beyond notifications from recursive watches. **Recommendations** Upgrade to version 3.9.4. Disable the snapshot and restore commands via `admin.snapshot.enabled` and `admin.restore.enabled`. Disable the AdminServer interface via `admin.enableServer`. Ensure the root ACL does not provide open permissions.

**Name of the Vulnerable Software and Affected Versions** Apache ZooKeeper versions prior to 3.7.2 Apache ZooKeeper versions prior to 3.8.3 Apache ZooKeeper versions prior to 3.9.1 **Description** The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability in Apache ZooKeeper. If SASL Quorum Peer authentication is enabled, the authorization check can be skipped if the instance part in the SASL authentication ID is missing. This allows an arbitrary endpoint to join the cluster and propagate counterfeit changes to the leader, giving it complete read-write access to the data tree. Quorum Peer authentication is not enabled by default. **Recommendations** To resolve the issue, upgrade to version 3.7.2, 3.8.3, or 3.9.1, which fixes the issue. Alternatively, ensure the ensemble election/quorum communication is protected by a firewall to mitigate the issue.