Deserialization of Untrusted Data in Apache Kafka - CVE-2023-25194

Vulnerability identifier: #VU72123

CSH Severity: Low

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-25194

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to Apache Kafka Connect performs deserialization of data retrieved from the configured LDAP server in "com.sun.security.auth.module.JndiLoginModule". A remote user ability to create/modify connectors on the server with an arbitrary Kafka client SASL JAAS config can configure the server to connect to a malicious LDAP server and execute arbitrary Java code on the system.

Apache Kafka
IBM Operator for Apache Flink
IBM Observability with Instana
z/Transaction Processing Facility ( z/TPF)
Log Analysis
Oracle Financial Services Behavior Detection Platform
Oracle Enterprise Data Quality
IBM Cloud Pak for Business Automation
Oracle Banking APIs
Oracle Communications Network Analytics Data Director
IBM Process Mining
IBM Spectrum Control
IBM Maximo Asset Management
IBM Maximo Application Suite
IBM Business Automation Workflow
Operations Analytics - Log Analysis
Oracle Financial Services Analytical Applications Infrastructure
IBM Security Verify Information Queue
Integration Bus for z/OS
InfoSphere Data Replication
Oracle Communications Network Charging and Control
Oracle Banking Digital Experience
webMethods BPM
watsonx.data
IBM Cloud Pak for Multicloud Management
IBM Disconnected Log Collector
Communications Service Catalog and Design
Oracle Financial Services Regulatory Reporting
Oracle Banking Corporate Lending Process Management
Oracle Banking Liquidity Management
Oracle Banking Trade Finance Process Management
Oracle Banking Branch
Oracle Banking Origination
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
IBM Data Risk Manager
Event Streams
IBM Qradar SIEM
Oracle Communications BRM - Elastic Charging Engine
IBM InfoSphere Information Server
IBM App Connect Enterprise
Operational Decision Manager

Install updates from vendor's website, which disables the problematic login modules usage in SASL JAAS configuration.

It is also recommended to validate connector configurations and only allow trusted JNDI configurations.

Apache Kafka - update to 3.4.0
IBM Operator for Apache Flink - update to 1.4.5
Operations Analytics - Log Analysis - update to 1.3.8.3 IF1
Log Analysis - update to 1.3.8.1
watsonx.data - update to 2.1
IBM Cloud Pak for Multicloud Management - update to 2.3.8
Event Streams - update to 11.1.5
IBM Security Verify Information Queue - update to 10.0.5
Integration Bus for z/OS - update to 10.1.0.6
IBM App Connect Enterprise - addressed in versions 12.0.12.16, 13.0.4.1
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.20, 22.0.2.4
IBM Disconnected Log Collector - update to 1.8.3
IBM Process Mining - update to 1.14.2
IBM Data Risk Manager - update to 2.0.6.16
IBM Spectrum Control - update to 5.4.10.1
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM Maximo Asset Management - update to 7.6.1.3.15
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 36, 8.11.0.1 Interim fix 17, 8.11.0.1 Interim fix 18, 8.11.1 Interim fix 7
webMethods BPM - update to 11.1 Fix 9
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF019, 22.0.2 IF003

• Exploit #9725 - cve-2023-25194 (A go-exploit for Apache Druid CVE-2023-25194) (April 19, 2024)
• Exploit #9129 - Apache Druid JNDI Injection RCE (June 24, 2023)

• https://kafka.apache.org/cve-list
• https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz

• Deserialization of untrused data in Apache Kafka Connect
• IBM z/Transaction Processing Facility update for Apache Kafka
• Deserialization of untrusted data in IBM Event Streams
• Deserialization of untrusted data in IBM Business Automation Workflow
• Deserialization of Untrusted Data in Oracle Financial Services Regulatory Reporting
• Multiple vulnerabilities in Oracle Financial Services Behavior Detection Platform
• Multiple vulnerabilities in Oracle Financial Services Analytical Applications Infrastructure
• Multiple vulnerabilities in Oracle Banking APIs
• Multiple vulnerabilities in Oracle Banking Digital Experience
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Security Verify Information Queue
• Deserialization of untrusted data in IBM InfoSphere Information Server
• Deserialization of untrusted data in IBM Spectrum Control
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Oracle Communications Network Charging and Control
• Multiple vulnerabilities in Oracle Communications Convergent Charging Controller
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in Oracle Enterprise Data Quality
• Deserialization of untrusted data in IBM Maximo Application Suite - Monitor Component
• Deserialization of untrusted data in IBM Process Mining
• Multiple vulnerabilities in IBM Data Risk Manager
• Deserialization of untrusted data in IBM Observability with Instana
• Multiple vulnerabilities in Communications Service Catalog and Design
• Multiple vulnerabilities in IBM Disconnected Log Collector
• Deserialization of untrusted data in IBM Maximo Asset Management
• Multiple vulnerabilities in IBM Cloud Pak for Multicloud Management
• Multiple vulnerabilities in IBM Operational Decision Manager
• Multiple vulnerabilities in IBM watsonx.data
• Multiple vulnerabilities in IBM App Connect Enterprise and IBM Integration Bus for z/OS
• Multiple vulnerabilities in IBM Log Analysis
• Multiple vulnerabilities in IBM Operations Analytics - Log Analysis
• Multiple vulnerabilities in IBM InfoSphere Data Replication
• Multiple vulnerabilities in Oracle Banking Branch
• Multiple vulnerabilities in Oracle Banking Supply Chain Finance
• Multiple vulnerabilities in Oracle Banking Trade Finance Process Management
• Multiple vulnerabilities in Oracle Banking Corporate Lending Process Management
• Multiple vulnerabilities in Oracle Banking Credit Facilities Process Management
• Multiple vulnerabilities in Oracle Banking Origination
• Multiple vulnerabilities in Oracle Banking Liquidity Management
• Multiple vulnerabilities in Oracle Banking Cash Management
• Multiple vulnerabilities in IBM Operator for Apache Flink
• Multiple vulnerabilities in IBM webMethods BPM