Vulnerability Directory | CVE-2023-25194 | Spring

Overview

Apache Kafka is a distributed streaming platform designed for building real-time data pipelines and event-driven applications at enterprise scale. It offers a high-throughput, fault-tolerant messaging system that enables applications to publish, store, and process continuous streams of records with low latency.

‍

A security vulnerability (CVE-2023-25194) has been identified in Apache Kafka, specifically affecting kafka-clients used within Kafka Connect, which allows authenticated operators to supply malicious SASL JAAS configurations when creating or modifying connectors. By setting a connector’s sasl.jaas.config to use com.sun.security.auth.module.JndiLoginModule, an attacker can cause the Kafka Connect worker to contact a rogue LDAP server and deserialize untrusted responses, potentially triggering harmful gadget chains on the server. This bypass of configuration safeguards can lead to unrestricted deserialization or remote code execution (RCE) when vulnerable classes exist on the classpath.

‍

Per OWASP: Insecure Deserialization occurs when applications deserialize untrusted data, allowing attackers to influence the execution flow of the system. Because many serialization frameworks can create objects, invoke code, or trigger class initializers during deserialization, a malicious payload can lead to severe consequences such as remote code execution, privilege escalation, or arbitrary internal state manipulation. Attackers may exploit this by submitting crafted serialized objects that cause the application to instantiate dangerous classes or execute unexpected logic. When vulnerable libraries or gadget chains are present, insecure deserialization can compromise the entire application or underlying server.

‍

This issue affects multiple versions of Apache Kafka kafka-clients.

Details

Module Info

Product: Apache Kafka
Affected packages: kafka-clients
Affected versions: >=2.3.0 <=3.3.2
GitHub repository: https://github.com/apache/kafka/
Published packages: https://central.sonatype.com/artifact/org.apache.kafka/kafka-clients
Package manager: Maven
Fixed In: NES for Spring Boot 2.7

‍

Vulnerability Info

This high-severity vulnerability is found in the kafka-client package in all published versions of Apache Kafka.

‍

By setting a connector’s sasl.jaas.config to use com.sun.security.auth.module.JndiLoginModule, an attacker can cause the Kafka Connect worker to contact a rogue LDAP server and deserialize untrusted responses

Steps To Reproduce

Unit tests were added to reproduce this issue apache/kafka@ae22ec1

Proof Of Concept

When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the sasl.jaas.config property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or

admin.override.sasl.jaas.config properties.

‍

This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attackers can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Mitigation

Only recent versions of Apache Kafka are community-supported. Only the recent community supported version will receive updates to address this issue. For more information, see here.

‍

Users of the affected components should apply one of the following mitigations: