CVE-2023-25194
highpriority · attend · 79EPSS 0.958 · 100 %ileexploit · weaponizedDEEUUSEPSS · scored 2026-10-22
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (4)
Public proof-of-concept and weaponised exploit code.
- exploit/multi/http/apache_druid_cve_2023_25194Apache Druid JNDI Injection RCEweaponized · metasploit
- YongYe-Security/CVE-2023-25194CVE-2023-25194 ScanPoC · poc_in_github
- ohnonoyesyes/CVE-2023-25194ohnonoyesyes/CVE-2023-25194PoC · poc_in_github
- vulncheck-oss/cve-2023-25194A go-exploit for Apache Druid CVE-2023-25194PoC · poc_in_github
affected products (15)
Products and version ranges known to be affected.
- IBM App Connect Enterprise 12.0.1.0-12.0.12.15all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:12.0.1.0_-_12.0.12.15
- IBM App Connect Enterprise 13.0.1.0-13.0.4.0all versionscert_bundDEcpe:/a:ibm:app_connect_enterprise:13.0.1.0_-_13.0.4.0
- IBM Integration Bus for z/OS 10.1.0.0-10.1.0.5all versionscert_bundDEcpe:/a:ibm:integration_bus:10.1.0.0_-_10.1.0.5::for_zos
- IBM Maximo Asset Management 7.6.1.3all versionscert_bundDEcpe:/a:ibm:maximo_asset_management:7.6.1.3
- IBM Operational Decision Manager 8.10.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.10.x
- IBM Operational Decision Manager 8.11.xall versionscert_bundDEcpe:/a:ibm:operational_decision_manager:8.11.x
advisories (9)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2023-0300Apache Kafka: Schwachstelle ermöglicht CodeausführungDeutsch2023-02-07csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Apache Kafka ausnutzen, um beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2023-1017Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2023-04-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1807Oracle Fusion Middleware: Mehrere SchwachstellenDeutsch2023-07-18csaf · cert_bundDE
Ein Angreifer aus dem angrenzenden Netzwerk oder ein entfernter anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Oracle Fusion Middleware ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1808Oracle Financial Services Applications: Mehrere SchwachstellenDeutsch2023-07-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Financial Services Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1812Oracle Communications: Mehrere SchwachstellenDeutsch2023-07-18csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-1813Oracle Communications Applications: Mehrere SchwachstellenDeutsch2023-07-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2023-2700Atlassian Confluence: Mehrere SchwachstellenDeutsch2023-10-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Atlassian Confluence, Atlassian Jira Software, Atlassian Bitbucket und Atlassian Bamboo ausnutzen, um Administratorrechte zu erlangen, Informationen offenzulegen, beliebigen Programmcode auszuführen oder einen Denial of Service Zustand herbeizuführen.
- WID-SEC-W-2024-0107Oracle Communications Applications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- GHSA-26f8-x7cc-wqpcApache Kafka Connect vulnerable to Deserialization of Untrusted Data2023-02-07ghsa · osvUS
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- https://cxsecurity.com/cveshow/CVE-2023-25194/cnnvd
- https://kafka.apache.org/cve-listcnnvd
- https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyzcnnvd
- https://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.htmlcnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.3839cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.5764cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.6140cnnvd
- https://www.oracle.com/security-alerts/cpujan2024.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan