Arbitrary File Read and SSRF Vulnerability in Apache Kafka Client Configuration
Apache Kafka Client has a vulnerability related to arbitrary file read and server-side request forgery (SSRF). The issue stems from SASL/OAUTHBEARER configuration settings like "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url". When untrusted parties can specify Apache Kafka Client configurations, attackers may read arbitrary disk contents, access environment variables, or send requests to unintended locations. This vulnerability is particularly concerning in Apache Kafka Connect, where it could allow escalation from REST API access to broader system access. To address this, Apache Kafka introduced a system property ("-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls") to control allowed URLs. In version 3.9.1, all URLs are permitted by default for compatibility, while version 4.0.0 and newer require explicit URL configuration, with an empty list as the default setting.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
apache software foundation apache kafka client |
Vulmon