CVE-2024-51504

What it actually does

Authentication bypass in ZooKeeper Admin Server IPAuthenticationProvider by spoofing client IP via untrusted HTTP headers such as X-Forwarded-For, allowing execution of privileged commands including snapshot and restore.

Why it matters to the business

Attackers can trigger unauthorized data exposure or service disruption on affected ZooKeeper deployments until systems are updated.

How an attack unfolds

An attacker identifies the ZooKeeper Admin Server endpoint, crafts HTTP requests containing a spoofed X-Forwarded-For header to impersonate an authorized IP address, bypasses the weak default IP authentication, and issues arbitrary administrative commands such as snapshot or restore.

How to fix it

Upgrade ZooKeeper to version 3.9.3 or later; disable or reconfigure IPAuthenticationProvider to use a trusted proxy or source IP validation that does not honor untrusted headers.

How to confirm the fix worked

Confirm running version is at least 3.9.3; test that Admin Server rejects requests with spoofed X-Forwarded-For headers from untrusted sources.

Typical attack path

1. Locate publicly reachable ZooKeeper Admin Server
2. Send crafted HTTP request with spoofed X-Forwarded-For header
3. Bypass IP-based authentication
4. Execute privileged commands such as snapshot or restore

How to detect it

Inspect Admin Server access logs for requests containing X-Forwarded-For headers originating from unexpected sources combined with execution of snapshot or restore commands.

• X-Forwarded-For header in Admin Server requests
• snapshot command in Admin Server logs
• restore command in Admin Server logs

What your security team should do

• Immediately upgrade all ZooKeeper instances to 3.9.3
• Review and harden Admin Server authentication configuration
• Restrict Admin Server network exposure to trusted management networks only