CVE-2023-25194: Apache Kafka Connect RCE Vulnerability

CVE-2023-25194 Overview

A critical security vulnerability has been identified in Apache Kafka Connect API that allows authenticated attackers to achieve remote code execution through JNDI injection. The vulnerability exists in the handling of SASL JAAS configurations, where an authenticated operator with access to a Kafka Connect worker can manipulate connector configurations to trigger malicious LDAP lookups and subsequent Java deserialization attacks.

When configuring connectors via the Kafka Connect REST API, an authenticated operator can set the sasl.jaas.config property to use com.sun.security.auth.module.JndiLoginModule. This can be accomplished through the producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config properties. By exploiting this misconfiguration, an attacker can force the server to connect to a malicious LDAP server and deserialize untrusted LDAP responses, potentially leading to unrestricted deserialization of untrusted data or full remote code execution when compatible gadget chains are present in the classpath.

Critical Impact

Authenticated attackers can achieve remote code execution on Kafka Connect servers through JNDI injection and Java deserialization attacks, potentially compromising entire data streaming infrastructure.

Affected Products

• Apache Kafka Connect versions 2.3.0 through 3.3.x (default vulnerable configuration since 3.0.0)
• Apache Kafka Connect versions prior to 3.0.0 (vulnerable with non-default connector client override policies)
• Systems with vulnerable deserialization gadget chains in the classpath

Discovery Timeline

• 2023-02-07 - CVE CVE-2023-25194 published to NVD
• 2025-03-25 - Last updated in NVD database

Technical Details for CVE-2023-25194

Vulnerability Analysis

This vulnerability is classified as Insecure Deserialization (CWE-502) and represents a severe threat to organizations running Apache Kafka Connect clusters. The attack chain combines JNDI injection with Java deserialization vulnerabilities, a well-known attack pattern that has been leveraged in numerous high-profile security incidents including Log4Shell.

The core issue stems from insufficient restrictions on the SASL JAAS configuration parameters that can be specified through the Kafka Connect REST API. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations by default. Prior to version 3.0.0, this was only possible if administrators explicitly configured a permissive connector client override policy.

Root Cause

The root cause is the unrestricted ability for authenticated operators to configure the JndiLoginModule as part of the SASL authentication mechanism for Kafka connectors. The com.sun.security.auth.module.JndiLoginModule performs JNDI lookups that can be redirected to attacker-controlled LDAP servers. When the Kafka Connect server processes the malicious LDAP response, it deserializes the returned object without proper validation, enabling exploitation of any deserialization gadget chains present in the application's classpath.

Attack Vector

The attack requires network access and low-privilege authentication to the Kafka Connect REST API. An attacker must be able to create or modify connector configurations on a Kafka Connect worker. The exploitation flow involves:

1. The attacker authenticates to the Kafka Connect REST API with valid credentials
2. A connector configuration is created or modified with a malicious sasl.jaas.config value pointing to the attacker's LDAP server
3. When the connector attempts to authenticate, it contacts the attacker's LDAP server
4. The LDAP server responds with a serialized Java object containing a malicious gadget chain
5. The Kafka Connect server deserializes the object, executing the attacker's payload

The specific configuration parameters that can be abused include:

• producer.override.sasl.jaas.config
• consumer.override.sasl.jaas.config
• admin.override.sasl.jaas.config

Detection Methods for CVE-2023-25194

Indicators of Compromise

• Unexpected outbound LDAP connections (port 389/636) from Kafka Connect servers to unknown external hosts
• Connector configurations containing references to JndiLoginModule or com.sun.security.auth.module.JndiLoginModule
• Suspicious REST API calls to Kafka Connect endpoints modifying sasl.jaas.config properties
• Unusual process execution or network activity originating from Kafka Connect worker processes

Detection Strategies

• Monitor Kafka Connect REST API logs for connector configuration changes involving SASL JAAS properties
• Implement network segmentation rules that alert on outbound LDAP traffic from Kafka Connect infrastructure
• Deploy endpoint detection rules to identify deserialization attack patterns and suspicious Java process behavior
• Audit connector configurations periodically for unauthorized or suspicious JNDI-related settings

Monitoring Recommendations

• Enable detailed logging for Kafka Connect REST API authentication and configuration changes
• Configure alerts for any modifications to connector client override properties
• Monitor for new or modified connectors that specify custom SASL configurations
• Implement real-time monitoring of outbound network connections from Kafka Connect workers

How to Mitigate CVE-2023-25194

Immediate Actions Required

• Upgrade to Apache Kafka 3.4.0 or later where JndiLoginModule is disabled by default
• For versions prior to 3.4.0, add the JVM system property -Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule to disable the problematic login module
• Audit all existing connector configurations for suspicious SASL JAAS settings
• Restrict network egress from Kafka Connect workers to prevent connections to unauthorized LDAP servers

Patch Information

Apache has addressed this vulnerability in Kafka 3.4.0 by disabling the com.sun.security.auth.module.JndiLoginModule by default. The fix introduces a system property (-Dorg.apache.kafka.disallowed.login.modules) that administrators can use to explicitly disable problematic login modules. Organizations should upgrade to version 3.4.0 or later to benefit from this protection. For detailed patch information, refer to the Apache Kafka CVE List and the Apache Mailing List Discussion.

Workarounds

• Implement a custom connector client config override policy to restrict which Kafka client properties can be overridden in connector configurations
• Validate all connector configurations before deployment and reject any containing JNDI-related configurations
• Review and remove unnecessary deserialization gadget libraries from the Kafka Connect classpath where possible
• Implement strict network controls to block outbound LDAP traffic from Kafka Connect infrastructure

# Configuration example - Disable JndiLoginModule in Kafka Connect
# Add to your Kafka Connect startup script or environment
export KAFKA_OPTS="-Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule"

# Or add to connect-distributed.sh / connect-standalone.sh
# KAFKA_OPTS="-Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule"