HomePentest-Tools.com Logo

Apache Kafka - Remote Code Execution CVE-2023-25194

Severity
CVSSv3 Score
9.8
Vulnerability description

Apache Kafka is vulnerable to CVE-2023-25194, a Remote Code Execution vulnerability. The root cause of this vulnerability is the insufficient validation of parameters passed to the Apache Kafka Connect API. This allows JNDI query injection into SASL JAAS config and, therefore, it makes a request to connect to the attacker's LDAP server, which the attacker can use to execute Java deserialization gadget chains on the Kafka connect server.

Risk description

The risk exists that an unauthenticated remote attacker could gain Remote Code Execution access which will result in a fully compromised server through which they could steal confidential information, install ransomware, or pivot to the internal network.

Exploit capabilities

Sniper can gain unauthenticated Remote Code Execution on the target system and extract multiple artefacts as evidence.

Recommendation

Update Apache Kafka to the latest version available.

Codename
Not available
Detectable with
Network Scanner
Scan engine
Sniper
Exploitable with Sniper
Yes
CVE Published
Feb 7, 2023
Detection added at
Software Type
Stream processing
Vendor
Apache
Product
Kafka