Improper authentication in Apache Kafka - CVE-2024-56128

Vulnerability identifier: #VU101829

CSH Severity: Medium

CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-56128

CWE-ID: CWE-287

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in Salted Challenge Response Authentication Mechanism (SCRAM) implementation. The application does not verify that the nonce sent by the client in the second message matches the nonce sent by the server in its first message. A remote attacker with access to plain text SCRAM authentication exchange can bypass forge the second once and gain unauthorized access to the application.

Apache Kafka
Log Analysis
Splunk User Behavior Analytics (UBA)
Oracle Communications Unified Inventory Management
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
watsonx.data
Communications Unified Assurance
Oracle Communications Billing and Revenue Management
Oracle Communications Convergent Charging Controller
Oracle Communications Network Charging and Control
Oracle Banking Digital Experience
Oracle Banking Origination
AMQ Streams

Install updates from vendor's website.

Apache Kafka - addressed in versions 3.7.2, 3.8.1
Log Analysis - update to 1.3.8.1
watsonx.data - update to 2.1.1
Splunk User Behavior Analytics (UBA) - update to 5.4.3
AMQ Streams - addressed in versions 2, 3.1.0

• https://lists.apache.org/thread/lgf0cys1zr7hqgkx58vn28p0frsmom2b
• https://github.com/advisories/GHSA-p7c9-8xx8-h74f

• Improper authentication in Apache Kafka SCRAM implementation
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in Oracle Communications Billing and Revenue Management
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• IBM watsonx.data update for Apache Kafka's SCRAM
• IBM Operations Analytics - Log Analysis update for Apache Kafka's SCRAM
• Multiple vulnerabilities in AMQ Streams
• Improper authentication in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in Communications Unified Assurance
• Improper authentication in Oracle Communications Convergent Charging Controller
• Multiple vulnerabilities in Oracle Banking Origination
• Splunk User Behavior Analytics (UBA) update for third-party components
• Red Hat AMQ Streams update for Apache Kafka