Apache Zookeeper Unauthenticated Access

zookeeper-unauthenticated-access is a critical severity check in the messaging category, written in yaml. Its source is templates/messaging/zookeeper/zookeeper-unauthenticated.yaml in cert-x-gen-templates.

What it checks

Detects Apache Zookeeper instances exposed without authentication. Unauthenticated Zookeeper access allows:

• Configuration tampering
• Service disruption
• Data manipulation in distributed systems

Header

Field	Value
Id	zookeeper-unauthenticated-access
Severity	critical
Language	yaml
Category	messaging
Author	CERT-X-GEN Security Team
Template version	not recorded
Confidence	95
CVSS	not recorded
Weakness	CWE-306
Tags	zookeeper, apache, unauthenticated, distributed-systems, coordination, network
Target kind	not recorded
Oracle	not recorded

The file declares extractors, http, network, remediation as well. Those are not tabled above; read the source for what they carry.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://cwe.mitre.org/data/definitions/306.html
• https://zookeeper.apache.org/doc/current/zookeeperProgrammers.html#sc_ZooKeeperAccessControl
• https://cwiki.apache.org/confluence/display/ZOOKEEPER/Zookeeper+and+SASL

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info zookeeper-unauthenticated-access

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• messaging is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.