Skip to content
OpenAdvisories
Medium · 6.5 CVE-2024-31141 EUVD-2024-3337GHSA-2x2g-32r7-p4x8

Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

Published Nov 19, 2024 · Updated Jan 31, 2025 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Kafka Clients Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-toolkit Package: druid Package: druid-compat Package: kafka_exporter-strimzi-compat Package: kafka-strimzi-compat Package: logstash-8-with-output-opensearch Package: org.apache.kafka:kafka-clients Package: prometheus-jmx-exporter-strimzi-compat Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: thingsboard Package: thingsboard-tb-js-executor Package: thingsboard-tb-mqtt-transport Package: thingsboard-tb-node Package: thingsboard-tb-web-ui Ecosystem: Maven Ecosystem: Wolfi

Description

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.

Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.
In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.

In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.
This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.

Users with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property "org.apache.kafka.automatic.config.providers=none".
Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate "allowlist.pattern" and "allowed.paths" to restrict their operation to appropriate bounds.

For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.
For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Kafka Clients 2.3.0 – ≤ 3.5.2, 3.6.0 – ≤ 3.6.2, 3.7.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache-nifi +2 2.0.0-r4 —
Wolfi rolling druid +1 31.0.0-r2 —
Wolfi rolling kafka-strimzi-compat +12 0.44.0-r2 —
Wolfi rolling logstash-8-with-output-opensearch 8.16.1-r1 —
Wolfi rolling thingsboard +4 3.8.1-r4 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.kafka:kafka-clients >= 2.3.0, < 3.7.1 3.7.1 GHSA-2x2g-32r7-p4x8

Advisories 5

References