CVE-2024-41169: Apache Zeppelin exposes server resources to unauthenticated attackers

The vulnerability lies in the unauthenticated nature of the raft-based cluster feature in Apache Zeppelin. An attacker could exploit this to view sensitive server resources. The analysis of the patch, which completely removes the cluster implementation, confirms that the entire feature was considered a security risk. The primary entry point for an attacker would be the unauthenticated REST API endpoints provided by ClusterRestApi. These endpoints, specifically getClusterNodes and getClusterNode, would allow an attacker to easily retrieve information about the servers in the cluster. These REST endpoints in turn call ClusterManagerServer.getClusterMeta to fetch the data from the raft cluster. The root cause is the lack of authentication in the raft server protocol itself, which was handled by classes like ClusterManagerServer and ClusterStateMachine. The most direct and observable vulnerable functions in a runtime profile would be the methods in ClusterRestApi, as they are the highest-level functions accessible to an external attacker.