PT-2023-19973 · Apache+1 · Apache Kafka Connect+3

4Ra1N + 2 · Published 2023-02-07 · Updated 2025-08-18 · CVE-2023-25194

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Kafka Connect versions prior to 3.4.0 Apache Kafka versions 2.3.0 through 3.3.x Bitbucket Data Center and Server versions 7.21.0 through 8.12.0

Description A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the sasl.jaas.config property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.

Recommendations For Apache Kafka Connect versions prior to 3.4.0, upgrade to Apache Kafka Connect 3.4.0 or later. For Bitbucket Data Center and Server versions 7.21.0 through 8.12.0, upgrade to the specified supported fixed versions:

• Bitbucket Data Center and Server 7.21: Upgrade to a release greater than or equal to 7.21.16
• Bitbucket Data Center and Server 8.9: Upgrade to a release greater than or equal to 8.9.4
• Bitbucket Data Center and Server 8.10: Upgrade to a release greater than or equal to 8.10.4
• Bitbucket Data Center and Server 8.11: Upgrade to a release greater than or equal to 8.11.3
• Bitbucket Data Center and Server 8.12: Upgrade to a release greater than or equal to 8.12.1 As a temporary workaround, consider disabling the com.sun.security.auth.module.JndiLoginModule in the SASL JAAS configuration. Restrict access to the Kafka Connect REST API to minimize the risk of exploitation. Validate connector configurations and only allow trusted JNDI configurations. Examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation.

Exploit

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2023-25194

GHSA-26F8-X7CC-WQPC

Affected Products

Apache Kafka

Apache Kafka Connect

Bitbucket

Bitbucket Server

References · 22

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/apache_druid_cve_2023_25194.rb · Exploit
• 🔥 https://github.com/ohnonoyesyes/CVE-2023-25194 · Exploit
• 🔥 https://github.com/Veraxy00/Flink-Kafka-Vul · Exploit
• https://osv.dev/vulnerability/CVE-2023-25194 · Vendor Advisory
• https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25194 · Security Note
• https://kafka.apache.org/cve-list · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-26f8-x7cc-wqpc · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-25194 · Security Note
• https://github.com/apache/kafka · Note
• https://jira.atlassian.com/browse/BSERV-18834 · Note
• https://t.me/ckure/12114 · Telegram Post
• http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html · Note
• https://hackerone.com/reports/1529790 · Note
• https://t.me/cvenotify/116093 · Telegram Post