[<prev] [next>] [day] [month] [year] [list]
Message-ID: <663a6e87-b184-0f42-0080-5415c5d6d297@apache.org>
Date: Mon, 09 Jun 2025 11:49:14 +0000
From: Luke Chen <showuon@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2025-27819: Apache Kafka: Possible RCE/Denial of service
attack via SASL JAAS JndiLoginModule configuration
Severity: important
Affected versions:
- Apache Kafka 2.0.0 through 3.3.2
Description:
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.security.auth.module.LdapLoginModule" is disabled by default in in Apache Kafka 3.9.1/4.0.0
Credit:
Ziyang Li (finder)
Ji'an Zhou (finder)
Ying Zhu (finder)
References:
https://kafka.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-27819
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
