I was performing a security test for a client when I came across a Zookeeper installation on xx.x.x.xx:2181. Trying NetCat revealed that I'm able to all the following commands:
dump: Lists the outstanding sessions and ephemeral nodes. This only works on the leader.
envi: Print details about serving environment
kill: Shuts down the server. This must be issued from the machine the ZooKeeper server is running on. (Haven't tried this one)
reqs: List outstanding requests
ruok: Tests if server is running in a non-error state. The server will respond with imok if it is running. Otherwise it will not respond at all.
srst: Reset statistics returned by stat command.
stat: Lists statistics about performance and connected clients.
I'm not familiar with Zookeeper so please excuse me if this sounds like a stupid question but is Zookeeper supposed to be accessible without authentication? and also what are the implications of having this application exposed?
Any help is really appreciated, Thank you