Bug 2292856 (CVE-2024-36543) - CVE-2024-36543 kafka: malicious connector steal Kafka SASL credentials querying the MirrorMaker Kafka REST API
Summary: CVE-2024-36543 kafka: malicious connector steal Kafka SASL credentials queryi...
Keywords:
Status: NEW
Alias: CVE-2024-36543
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 2292855
TreeView+ depends on / blocked
 
Reported: 2024-06-18 06:02 UTC by Rohit Keshri
Modified: 2024-06-18 16:26 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Rohit Keshri 2024-06-18 06:02:04 UTC 
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.

http://strimzi.com
https://github.com/almounah/vulnerability-research/tree/main/CVE-2024-36543
Note You need to log in before you can comment on or make changes to this bug.