A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without validating its signature, issuer, or audience. An attacker can generate a JWT token from any issuer with the `preferred_username` set to any user, and the broker will accept it. We advise the Kafka users using kafka v4.1.0 or v4.1.1 to set the config `sasl.oauthbearer.jwt.validator.class` to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` explicitly to avoid this vulnerability. Since Kafka v4.1.2 and v4.2.0 and later, the issue is fixed and will correctly validate the JWT token.
The default value of the property `sasl.oauthbearer.jwt.validator.class` is `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`, which does not perform any cryptographic verification of the JWT token. An attacker can independently craft a JWT token with any chosen issuer and the `preferred_username` field set to the name of any user. The Apache Kafka broker will accept such a token without objection, treating the attacker as an authenticated user with the specified identity.
A remote attacker without authentication can impersonate any Kafka broker user, gaining unauthorized access to data (read and write) transmitted through the cluster, which may lead to disclosure of sensitive information and manipulation of data streams.
For versions v4.1.0 and v4.1.1, the property `sasl.oauthbearer.jwt.validator.class` must be immediately set to `org.apache.kafka.common.security.oauthbearer.BrokerJwtValidator` in the broker configuration. It is recommended to upgrade to Apache Kafka version v4.1.2 or v4.2.0 (or newer), in which the issue has been permanently fixed.
Apache Kafka in versions v4.1.0 and v4.1.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NApache Kafka
APPApache4.1.0 – 4.1.2 (excl.)
Related vulnerabilities
A race condition in the Apache Kafka Java producer client’s buffer pool management can cause messages to be si...
A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka...
In CVE-2023-25194, we announced the RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration i...
A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig t...
While an Apache Kafka cluster is being migrated from ZooKeeper mode to KRaft mode, in some cases ACLs will not...