Main Vulnerability Database Vulnerabilities #VU79928

Deserialization of Untrusted Data in Spring for Apache Kafka - CVE-2023-34040

Published: August 23, 2023 / Updated: August 31, 2023

Vulnerability identifier: #VU79928

CSH Severity: Medium

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34040

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system under certain conditions.

Affected software

Spring for Apache Kafka
IBM Qradar SIEM
Juniper Secure Analytics (JSA)
IBM Maximo Application Suite
Netcool Operations Insight
IBM Data Risk Manager

How to mitigate CVE-2023-34040

Install updates from vendor's website.

Spring for Apache Kafka - addressed in versions 2.9.11, 3.0.10
IBM Qradar SIEM - update to 7.5.0 Update Pack 7 IF03
Juniper Secure Analytics (JSA) - update to 7.5.0 UP7 IF03
IBM Maximo Application Suite - update to 8.10.5
Netcool Operations Insight - update to 1.6.11
IBM Data Risk Manager - update to 2.0.6.20

Links to Public Exploits and PoC-codes

Exploit #9272 - Spring-Kafka-POC-CVE-2023-34040 (POC for Spring Kafka Deserialization Vulnerability CVE-2023-34040) (August 31, 2023)

External References

https://spring.io/security/cve-2023-34040