Summary
Cruise Control contains an authentication-bypass vulnerability in its Jetty security constraint handling and request-path normalization. Certain requests can be routed to administrative endpoints without authentication, potentially exposing all 15 admin operations when the Cruise Control service is reachable by an attacker.
In AMQ Streams deployments, the Strimzi operator's NetworkPolicy may limit access to port 9090 to operator pods, reducing the practical exposure and severity.
Cruise Control contains an authentication-bypass vulnerability in its Jetty security constraint handling and request-path normalization. Certain requests can be routed to administrative endpoints without authentication, potentially exposing all 15 admin operations when the Cruise Control service is reachable by an attacker.
In AMQ Streams deployments, the Strimzi operator's NetworkPolicy may limit access to port 9090 to operator pods, reducing the practical exposure and severity.
Affected context
The issue occurs in Cruise Control deployments where:
- Jetty security constraints are registered for exact paths without a catch-all constraint
- Uncovered HTTP methods are not denied by default
- Servlet routing derives the endpoint from a normalized filename component of the request path
- The Cruise Control administrative port is reachable from an untrusted or insufficiently restricted network
Deployments with network policies that restrict port 9090 to trusted operator components have a narrower attack surface.
The issue occurs in Cruise Control deployments where:
- Jetty security constraints are registered for exact paths without a catch-all constraint
- Uncovered HTTP methods are not denied by default
- Servlet routing derives the endpoint from a normalized filename component of the request path
- The Cruise Control administrative port is reachable from an untrusted or insufficiently restricted network
Deployments with network policies that restrict port 9090 to trusted operator components have a narrower attack surface.
Exploit preconditions
- Attack surface: HTTP access to the Cruise Control administrative service
- Required access: Network reachability to the Cruise Control port; valid credentials may not be required
- Trigger point: Request routing and authorization evaluation for administrative endpoint paths
- Why exploitation is possible: Path normalization removes leading path segments and trailing slashes, while exact security constraints do not comprehensively cover the resulting routes or methods
- Attack surface: HTTP access to the Cruise Control administrative service
- Required access: Network reachability to the Cruise Control port; valid credentials may not be required
- Trigger point: Request routing and authorization evaluation for administrative endpoint paths
- Why exploitation is possible: Path normalization removes leading path segments and trailing slashes, while exact security constraints do not comprehensively cover the resulting routes or methods
Why this happens
The underlying bug is an authorization coverage failure caused by the interaction between request-path normalization and narrowly scoped Jetty security constraints.
The servlet uses a filename-oriented path operation that collapses distinct request paths into the same endpoint name. Because the security handler does not deny uncovered HTTP methods and lacks a catch-all constraint, some normalized requests can reach administrative handlers without passing the intended authentication requirement.
This maps to CWE-287: Improper Authentication, because protected administrative functionality can be accessed without establishing the required identity.
The underlying bug is an authorization coverage failure caused by the interaction between request-path normalization and narrowly scoped Jetty security constraints.
The servlet uses a filename-oriented path operation that collapses distinct request paths into the same endpoint name. Because the security handler does not deny uncovered HTTP methods and lacks a catch-all constraint, some normalized requests can reach administrative handlers without passing the intended authentication requirement.
This maps to CWE-287: Improper Authentication, because protected administrative functionality can be accessed without establishing the required identity.
Potential impact
- Unauthorized access to Cruise Control administrative endpoints
- Modification of balancing, execution, or operational settings
- Disruption of Kafka cluster-management activities
- Exposure of administrative response data
- Potential secondary impact to Kafka infrastructure, depending on endpoint privileges and deployment permissions
- Unauthorized access to Cruise Control administrative endpoints
- Modification of balancing, execution, or operational settings
- Disruption of Kafka cluster-management activities
- Exposure of administrative response data
- Potential secondary impact to Kafka infrastructure, depending on endpoint privileges and deployment permissions
General mitigation guidance
Mitigation generally focuses on making authorization coverage explicit and preventing path normalization from weakening access controls.
Common defensive patterns include:
- Applying authentication and authorization to a catch-all set of paths and methods
- Denying uncovered HTTP methods by default
- Preserving and validating the complete request path before endpoint dispatch
- Separating public health or metadata routes from administrative routes
- Restricting administrative ports with network policy, firewall rules, and trusted-service allowlists
- Running Cruise Control and its operator integration with least-privilege identities
- Treating requests that normalize ambiguously as invalid rather than routing them to privileged handlers
Mitigation generally focuses on making authorization coverage explicit and preventing path normalization from weakening access controls.
Common defensive patterns include:
- Applying authentication and authorization to a catch-all set of paths and methods
- Denying uncovered HTTP methods by default
- Preserving and validating the complete request path before endpoint dispatch
- Separating public health or metadata routes from administrative routes
- Restricting administrative ports with network policy, firewall rules, and trusted-service allowlists
- Running Cruise Control and its operator integration with least-privilege identities
- Treating requests that normalize ambiguously as invalid rather than routing them to privileged handlers
How teams detect issues like this
Organizations can identify similar authorization gaps through:
- Static analysis for filename-based request routing and incomplete security constraint declarations
- Code review checks comparing every administrative route and HTTP method with its authentication policy
- Integration tests covering alternate path forms, redundant segments, trailing slashes, and unexpected methods
- Policy checks verifying that administrative ports are reachable only from explicitly trusted components
- Runtime monitoring for unauthenticated requests reaching administrative endpoints or unusual path variants
Automated security testing and code-review tools can help detect discrepancies between route normalization and authorization coverage.
Organizations can identify similar authorization gaps through:
- Static analysis for filename-based request routing and incomplete security constraint declarations
- Code review checks comparing every administrative route and HTTP method with its authentication policy
- Integration tests covering alternate path forms, redundant segments, trailing slashes, and unexpected methods
- Policy checks verifying that administrative ports are reachable only from explicitly trusted components
- Runtime monitoring for unauthenticated requests reaching administrative endpoints or unusual path variants
Automated security testing and code-review tools can help detect discrepancies between route normalization and authorization coverage.
Sources
| Source | Link |
|---|---|
| access. | access.redhat.com/ |
| bugzilla. | bugzilla.redhat.com/ |
| github. | github.com/ |
