CVE-2024-27905

Apache Aurora endpoint leaks internal information to unauthenticated users. An attacker can exploit this endpoint as a padding oracle, allowing iterative guessing and forging of a valid authentication cookie. The obtained cookie can be used to impersonate an authenticated user, and when combined with other vulnerabilities, potentially enable RCE.

An unauthenticated attacker can gain access to Apache Aurora instances through forged cookies, resulting in breach of data confidentiality and integrity, and potentially — when combined with other vulnerabilities — remote code execution.

The vendor does not plan to release a patch due to project retirement. Migration to an alternative solution is recommended, or — if migration is not possible — strictly limit access to Apache Aurora instances only to trusted users (e.g., through firewall or VPN). Do not expose instances publicly.

Apache Aurora — all versions. The project is retired and will no longer be updated by maintainers.