RockteMQ-AI commented on issue #10956: URL: https://github.com/apache/rocketmq/issues/10956#issuecomment-5324303134
## 🔍 Automated Assessment **Type:** Security Enhancement **Severity:** HIGH **Status:** ✅ Verified against `develop` branch ### Analysis Code-level verification confirms the Controller remoting server lacks authentication and authorization entirely: | Aspect | Controller | Broker (for comparison) | |--------|-----------|----------------------| | `AuthConfig` initialization | ❌ Not present | ✅ Constructor parameter | | `AuthenticationPipeline` | ❌ Not present | ✅ Applied to all remoting servers | | `AuthorizationPipeline` | ❌ Not present | ✅ Applied to all remoting servers | | `RPCHook` registration | ❌ None | ✅ Supported | | Default bind address | `0.0.0.0` | Configurable | All 12 Controller request codes (`UPDATE_CONTROLLER_CONFIG`, `GET_CONTROLLER_CONFIG`, `CLEAN_BROKER_DATA`, `CONTROLLER_REGISTER_BROKER`, `CONTROLLER_GET_NEXT_BROKER_ID`, `CONTROLLER_APPLY_BROKER_ID`, etc.) are registered via `registerProcessor()` with no auth checks. The only existing "protection" is a config-key blacklist in `ControllerRequestProcessor` that prevents updating certain sensitive config keys — this is a property filter, not authentication. ### Proposed Fix Alignment The proposed fix is well-scoped and aligns with the existing Broker auth architecture: 1. Parse and initialize `AuthConfig` for standalone and embedded Controller startup paths 2. Install the existing `AuthenticationPipeline` → `AuthorizationPipeline` chain on the Controller remoting server 3. Map Controller request codes to cluster-level authorization contexts 4. Add regression tests for unauthenticated request rejection ### Temporary Mitigation Bind the Controller to a private interface and restrict network access via firewall rules. --- *🤖 Evaluated by github-manager | Code verified via static analysis on develop branch* -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
