With 78% of data breaches originating from authentication bypass flaws according to IBM’s 2025 Threat Intelligence Index, this vulnerability serves as a critical reminder to prioritize input validation in distributed architectures. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. Apache resolved the vulnerability in Pinot 1.3.0 through improved URI normalization using Java’s URI.normalize() method combined with regex-based path validation. Attackers can craft HTTP requests containing specially encoded sequences like %2e%2e/ or null-byte injections to bypass path normalization checks. Security analysts confirm this creates a direct pathway for remote code execution (RCE) through malicious query injections. Trend Micro’s Zero Day Initiative (ZDI), which tracked the flaw as ZDI-CAN-24001, confirms exploit code requires only basic HTTP manipulation skills. Rated 9.8 on the CVSS v3 scale – the maximum severity score – this flaw exposes organizations to data exfiltration, privilege escalation, and infrastructure compromise. She is covering various cyber security incidents happening in the Cyber Space. It mirrors recent vulnerabilities in Elasticsearch (CVE-2024-35253) and MongoDB Atlas (CVE-2024-48721), underscoring the need for runtime CVE monitoring in distributed systems. Apache Pinot’s architecture – designed for low-latency queries across petabyte-scale datasets – makes compromised instances high-value targets.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 12 Mar 2025 00:25:17 +0000