CVE-2023-25194

/// Technical description

A possible security vulnerability has been identified in Apache Kafka Connect API.

This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config

and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.

When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`

property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the

`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.

This will allow the server to connect to the attacker's LDAP server

and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.

Attacker can cause unrestricted deserialization of untrusted data (or) RCE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References