Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect
CVE-2023-25194

8.8HIGH

Key Information:

Vendor

Apache
Status
Apache Kafka Connect Api
Vendor
CVE Published:
7 February 2023

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%

What is CVE-2023-25194?

A security vulnerability exists in the Apache Kafka Connect API, allowing authenticated operators to manipulate connector configurations and introduce malicious JAAS settings. When exploiting this flaw, an attacker can connect to their own LDAP server through the Kafka Connect infrastructure, leading to potential remote code execution via deserialization. This vulnerability affects configurations starting from Apache Kafka Connect 2.3.0 and necessitates thorough validation of connector settings. Users are urged to utilize available security properties in newer versions and implement strict controls for connector configurations to mitigate associated risks.

Affected Version(s)

Apache Kafka Connect API 2.3.0 < 3.4.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

Metasploit exploit module for CVE-2023-25194
Created by Rapid7

CVE-2023-25194
Created by ohnonoyesyes

CVE-2023-25194
Created by YongYe-Security

References

https://kafka.apache.org/cve-list
release-notes
https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb...
vendor-advisory
http://packetstormsecurity.com/files/173151/Apache-Druid-...

EPSS Score

94% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Apache Kafka would like to thank to Jari Jääskelä (https://hackerone.com/reports/1529790) and 4ra1n and Y4tacker (they found vulnerabilities in other Apache projects. After discussion between PMC of the two projects, it was finally confirmed that it was the vulnerability of Kafka then they reported it to us)
JSON
.