Security restrictions bypass in Apache Kafka

1) Improper access control

EUVDB-ID: #VU19227

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1288

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to bypass certain security restrictions.

The vulnerability exists due to absent access controls when executing actions reserved for the Broker. A remote authenticated attacker can manually create fetch requests and interfere with data replication process that can lead to data loss.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kafka: 0.9.0.0 - 1.0.0

CPE2.3

• cpe:2.3:a:apache_foundation:apache_kafka:0.9.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.9.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.10.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.10.0.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.10.1.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.10.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.10.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.10.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.11.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:apache_foundation:apache_kafka:0.11.0.1:*:*:*:*:*:*:*

External links

https://lists.apache.org/thread.html/29f61337323f48c47d4b41d74b9e452bd60e65d0e5103af9a6bb2fef@%3Cusers.kafka.apache.org%3E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.