Improper authentication in Apache Kafka - CVE-2024-56128

Vulnerability identifier: #VU101829

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-56128

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Apache Kafka
Log Analysis
Splunk User Behavior Analytics (UBA)
Oracle Communications Unified Inventory Management
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
watsonx.data
Communications Unified Assurance
Oracle Communications Billing and Revenue Management
Oracle Communications Convergent Charging Controller
Oracle Communications Network Charging and Control
Oracle Banking Digital Experience
Oracle Banking Origination
AMQ Streams

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in Salted Challenge Response Authentication Mechanism (SCRAM) implementation. The application does not verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message. A remote attacker with access to plain text SCRAM authentication exchange can bypass forge the second once and gain unauthorized access to the application.

Install updates from vendor's website.

• https://lists.apache.org/thread/lgf0cys1zr7hqgkx58vn28p0frsmom2b
• https://github.com/advisories/GHSA-p7c9-8xx8-h74f