CVE-2024-31141
Description
A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations, which include the ability to read from disk or environment variables. In applications where an untrusted party can specify Apache Kafka Clients configurations, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.
Statement
Moderate impact affects Red Hat products and services that include Apache Kafka Clients when an attacker with low privileges can cause an application to process attacker-controlled client configuration. Over the network, and with high attack complexity, the attacker may abuse the automatic FileConfigProvider, DirectoryConfigProvider, or EnvVarConfigProvider to read arbitrary filesystem contents or environment variables; in Kafka Connect this can escalate REST API access to filesystem or environment access. The current record marks 24 Red Hat product or service streams as affected, with remediation delegated or deferred for some streams, while Red Hat AMQ amq-cl-2 and OpenShift Logging 5.8 and 5.9 are not affected because the vulnerable code is not present. Red Hat rates the issue CVSS 5.3 Moderate, lower than the external 6.5 Moderate score, because Red Hat assesses the attack complexity as high rather than low.
Mitigation
For applications in which an untrusted party can specify Apache Kafka Client configuration, disable automatic configuration providers by setting the JVM system property org.apache.kafka.automatic.config.providers=none. For Kafka Connect workers that must use the listed providers, restrict them with appropriate allowlist.pattern and allowed.paths settings. Upgrade kafka-clients to version 3.8.0 or later, or apply the applicable vendor fix. The system-property restriction is not recommended for Kafka Clients or Kafka Connect deployments where users are trusted with disk and environment access, or for Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 6.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
