Kroxylicious TLS Connection Flaw: High Complexity Attack with Data Integrity and Confidentiality Impact

CVE-2024-8285

Summary

A vulnerability exists in Kroxylicious where the software fails to adequately verify the hostname of an upstream Kafka server during the establishment of a TLS secured connection. This misconfiguration creates a potential for an attacker to execute a Man-in-the-Middle attack or compromise other external systems, such as DNS settings or network routing. Successful exploitation requires elevated privileges, allowing access to the Kroxylicious configuration or an associated peer system, thereby compromising both data integrity and confidentiality during data exchange.

References