Skip to content

Latest commit

 

History

History
98 lines (81 loc) · 7.24 KB

attack-surface.md

File metadata and controls

98 lines (81 loc) · 7.24 KB

Attack Surface Analysis for apache/zookeeper

Attack Surface: 1. Network Exposure (Client & Server Ports)

  • Description: Exposure of ZooKeeper's essential network ports to unauthorized access.
  • How ZooKeeper Contributes: ZooKeeper requires open ports for client communication (default 2181) and inter-server communication (defaults 2888, 3888). This is inherent to its operation.
  • Example: An attacker scans for open port 2181 and attempts to connect to a ZooKeeper instance without proper authentication.
  • Impact: Unauthorized access to ZooKeeper data, potential for data modification, denial-of-service, or compromise of the entire ZooKeeper ensemble.
  • Risk Severity: Critical (if unauthenticated/unauthorized access is possible) or High (if authentication is weak or misconfigured).
  • Mitigation Strategies:
    • Firewall Rules: Strictly limit access to ZooKeeper ports (2181, 2888, 3888) to only authorized client and server IPs/networks. Use a dedicated, isolated network segment.
    • Network Segmentation: Isolate ZooKeeper from the public internet and other untrusted networks.
    • VPN/Tunneling: Require clients to connect via a VPN or secure tunnel.
    • mTLS (Mutual TLS): Implement mTLS for inter-server communication.
    • Rate Limiting: Implement rate limiting on connection attempts.

Attack Surface: 2. Unauthenticated/Weak Authentication

  • Description: Lack of strong authentication for client connections to ZooKeeper.
  • How ZooKeeper Contributes: ZooKeeper supports authentication (SASL: Kerberos, DIGEST-MD5), but it is not enabled by default. It is the administrator's responsibility to configure it.
  • Example: A client connects to ZooKeeper without credentials, and the server allows it because authentication is not enforced.
  • Impact: Unauthorized read/write access to ZooKeeper data, leading to data breaches, configuration poisoning, and service disruption.
  • Risk Severity: Critical
  • Mitigation Strategies:
    • Enable Strong Authentication: Mandatory: Enable a strong authentication mechanism. Kerberos is strongly recommended. DIGEST-MD5 is significantly weaker and should only be considered in very limited, low-risk scenarios with strong password policies.
    • Credential Management: Implement secure credential storage and rotation.

Attack Surface: 3. Insufficient Authorization (ACLs)

  • Description: Poorly configured Access Control Lists (ACLs) granting excessive permissions.
  • How ZooKeeper Contributes: ZooKeeper uses ACLs to control access to znodes. Proper ACL configuration is entirely the responsibility of the administrator.
  • Example: A client has read/write access to a znode it shouldn't, containing sensitive data.
  • Impact: Data leakage, unauthorized configuration modification, privilege escalation.
  • Risk Severity: High
  • Mitigation Strategies:
    • Principle of Least Privilege: Grant only the minimum necessary permissions.
    • Specific ACLs: Avoid overly permissive defaults. Define specific ACLs for each znode.
    • Regular ACL Review: Periodically review and audit ACLs.

Attack Surface: 4. Unencrypted Communication

  • Description: Data transmitted without encryption (client-server and server-server).
  • How ZooKeeper Contributes: By default, ZooKeeper communication is unencrypted. TLS must be explicitly configured.
  • Example: An attacker on the network captures sensitive data transmitted in plain text.
  • Impact: Eavesdropping, man-in-the-middle (MITM) attacks, data manipulation.
  • Risk Severity: High
  • Mitigation Strategies:
    • Enable TLS: Mandatory: Enable TLS for both client-server and server-server communication. Use strong cipher suites.

Attack Surface: 5. Data Exposure (Snapshots & Logs)

  • Description: Unauthorized access to ZooKeeper's data files on the server's file system.
  • How ZooKeeper Contributes: ZooKeeper stores its data and transaction history in files on the local file system.
  • Example: An attacker with file system access reads the ZooKeeper data files.
  • Impact: Data breach, exposing sensitive configuration data.
  • Risk Severity: High
  • Mitigation Strategies:
    • File System Permissions: Use strict permissions to restrict access to the ZooKeeper data directory.
    • Data Encryption at Rest: Consider encrypting the ZooKeeper data directory.
    • File Integrity Monitoring: Detect unauthorized modifications to data files.

Attack Surface: 6. ZooKeeper Code Vulnerabilities

  • Description: Exploitable vulnerabilities within the ZooKeeper software.
  • How ZooKeeper Contributes: ZooKeeper, like any software, can have vulnerabilities.
  • Example: A newly discovered RCE vulnerability in ZooKeeper is exploited.
  • Impact: Remote code execution, denial-of-service, information disclosure, system compromise.
  • Risk Severity: Critical (depending on the vulnerability)
  • Mitigation Strategies:
    • Stay Updated: Mandatory: Keep ZooKeeper up-to-date with security patches.
    • Vulnerability Scanning: Consider using vulnerability scanners.

Attack Surface: 7. Misconfiguration

  • Description: Incorrect or insecure ZooKeeper configuration settings.
  • How ZooKeeper Contributes: ZooKeeper has many configuration options; incorrect settings create weaknesses.
  • Example: Setting maxClientCnxns too high (DoS vulnerability) or leaving "Four Letter Words" unrestricted.
  • Impact: Denial-of-service, information disclosure, unauthorized access.
  • Risk Severity: High
  • Mitigation Strategies:
    • Configuration Review: Thoroughly review and understand all configuration options.
    • Principle of Least Privilege: Configure with minimum necessary privileges.
    • Configuration Management: Use tools for consistent, secure configurations.
    • Restrict Four Letter Words: Use 4lw.commands.whitelist to control allowed commands.

Attack Surface: 8. Denial of Service (DoS)

  • Description: Attacks to make ZooKeeper unavailable to legitimate clients.
  • How ZooKeeper Contributes: ZooKeeper is a critical component; its unavailability disrupts the system.
  • Example: Flooding the server with connections, exceeding maxClientCnxns.
  • Impact: Service disruption.
  • Risk Severity: High
  • Mitigation Strategies:
    • Connection Limits: Configure appropriate maxClientCnxns.
    • Rate Limiting: Implement rate limiting and connection throttling.
    • Resource Monitoring: Monitor resources to detect DoS attempts.
    • Load Balancing: Consider a load balancer for resilience.