Apache Kafka Vulnerability Enables Privilege Escalation

A new vulnerability, CVE-2024-31141, was found in Apache Kafka Clients, allowing attackers to escalate privileges and gain unauthorized file access. Rated as Moderate, it affects several versions and is a concern for environments exposed to untrusted users, like SaaS products.

Apache Kafka Vulnerability

The vulnerability is due to improper privilege management in Apache Kafka Clients, specifically in the handling of external configuration providers (ConfigProviders).

Kafka Clients use ConfigProvider plugins, such as FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider, to allow custom configurations.

According to Apache’s report, these plugins can access sensitive data from the filesystem or environment variables. If an untrusted user can set Kafka Client configurations, they could exploit this flaw to read arbitrary files and environment variables.

This is especially dangerous in services like Apache Kafka Connect, where attackers could escalate from REST API access to filesystem or environment access.

In SaaS environments, where multiple users interact with Apache Kafka through APIs, this vulnerability could be used to access sensitive data stored on the disk or in environment variables.

Attackers with access to the Kafka Connect REST API might gain unauthorized access to the system’s filesystem.

Affected Versions

The vulnerability affects these versions of Apache Kafka Clients: