Authentication Algorithm Vulnerability in Apache Kafka
CVE-2024-56128
What is CVE-2024-56128?
The vulnerability arises from an incorrect implementation of the Salted Challenge Response Authentication Mechanism (SCRAM) in Apache Kafka. Specifically, the mechanism failed to verify that the nonce received from the client matched the one sent by the server, violating the specifications outlined in RFC 5802. This flaw occurs only when SCRAM is utilized over unencrypted (plaintext) communication channels, which is not recommended for security best practices. An attacker with access to such plaintext exchanges could potentially exploit this weakness. To mitigate risks, it is highly advisable to enable TLS for all SCRAM authentication implementations, ensuring the confidentiality and integrity of the authentication process. Upgrading to the recommended fixed versions of Apache Kafka (3.7.2 or later) is the preferred action for safeguarding against this vulnerability.