CVE-2019-0201

What it actually does

The getACL() command bypasses permission checks and returns ACL Id fields containing unsalted authentication hashes in plaintext when DigestAuthenticationProvider is active.

Why it matters to the business

Attackers may obtain reusable authentication material, enabling lateral movement or data exposure in systems that rely on ZooKeeper for coordination; the issue remains relevant in older deployments despite its age and low exploitation probability.

How an attack unfolds

An unauthenticated or low-privileged client issues a getACL request against a node; the server responds with full ACL details including the digest hash without verifying access rights, allowing the attacker to capture the value for offline cracking or replay.

How to fix it

Upgrade affected components to the listed fixed commits: openhab/openhab-addons to 4c4cb664f2e2c3866aadf117d22fb54aa8dd0031 and openhab/openhab-webui to 76c75a2098754135924370fd77e869f57ee91c8d; disable digest authentication or restrict getACL access until patched.

How to confirm the fix worked

Confirm upgraded package versions match the fixed commits, review ZooKeeper configuration to ensure permission checks are enforced on ACL operations, and test that getACL responses no longer expose hash values to unprivileged callers.

Typical attack path

1. Locate an exposed ZooKeeper endpoint using digest authentication
2. Send crafted getACL command for any node
3. Parse response to extract Id field hash
4. Crack or reuse captured hash to authenticate

How to detect it

Review ZooKeeper request logs for repeated or anomalous getACL operations originating from non-administrative clients; correlate with authentication events involving digest hashes.

What your security team should do

• Apply the specified fixed versions immediately on all ZooKeeper-dependent services
• Audit environments still using digest authentication and migrate to stronger mechanisms
• Monitor for getACL calls from unexpected clients until patches are deployed