CVE-2024-56325

CVE-2024-56325 is a critical authentication bypass (CWE-288) in Apache Pinot: when the request URL path is altered so it no longer matches the pattern the authentication check expects (per the disclosure, a path that does not contain '/' and contains characters such as a trailing dot), the endpoint processes the request without credentials. As demonstrated, an unauthenticated attacker can send a crafted POST to the /users endpoint on the controller port (9000 in the example) and successfully create a new user with the ADMIN role. The attacker thereby gains full control of the Pinot deployment, because that newly created administrative account can be used for further authenticated actions against the cluster. Any organization running Apache Pinot with its built-in authentication enabled is affected; the source data does not specify affected version ranges, so administrators should verify their version against the Apache security advisory. The flaw is not yet in CISA's KEV and no public proof-of-concept is known, but EPSS assigns an unusually high 80.2% probability of exploitation within 30 days (100th percentile), making rapid patching strongly advised.

What to do: Upgrade Apache Pinot to the fixed release identified in the official Apache security advisory as soon as practical; as an interim mitigation, restrict network access to the Pinot controller/API port (e.g., 9000) to trusted clients or place it behind an authenticating reverse proxy. Additionally, review existing user accounts for unexpectedly created ADMIN users and inspect access logs for POST requests to /users with manipulated paths (e.g., trailing semicolons or dots) indicating bypass attempts.