Описание
An improper authorization vulnerability has been identified in Apache Kafka.
The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata.
The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMER_GROUP_DESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists (ACLs), potentially allowing unauthorized users with DESCRIBE permission to access sensitive group metadata. This could result in unintended information disclosure or unauthorized access to group-related information.
Отчет
Moderate: An improper authorization flaw in Apache Kafka's CONSUMER_GROUP_DESCRIBE API could lead to information disclosure. This vulnerability allows users with only DESCRIBE permission on a GROUP resource to access sensitive group metadata, which should typically require READ permission. Exploitation relies on misconfigured Access Control Lists (ACLs) within the Kafka environment.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Serverless | openshift-serverless-1/kn-ekb-dispatcher-rhel9 | Not affected | ||
| OpenShift Serverless | openshift-serverless-1/kn-ekb-receiver-rhel9 | Not affected | ||
| Red Hat build of Apache Camel 4 for Quarkus 3 | kafka-clients | Fix deferred | ||
| Red Hat build of Apache Camel for Spring Boot 4 | kafka-clients | Not affected | ||
| Red Hat build of Apicurio Registry 3 | connect-api | Not affected | ||
| Red Hat build of Apicurio Registry 3 | connect-json | Not affected | ||
| Red Hat build of Apicurio Registry 3 | kafka-clients | Not affected | ||
| Red Hat build of Debezium 3 | connect-api | Fix deferred | ||
| Red Hat build of Debezium 3 | connect-json | Fix deferred | ||
| Red Hat build of Debezium 3 | connect-runtime | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
An improper authorization vulnerability has been identified in Apache ...
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMER_GROUP_DESCRIBE (69) API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This discrepancy can result in misconfigured Access Control Lists (ACLs) and unintended security postures, like granting READ permission to users who should not be able to join/sync groups, or allowing users without READ permission (but with DESCRIBE permission) to access sensitive group metadata. The correct permission for CONSUMER_GROUP_DESCRIBE API is DESCRIBE GROUP so the current implementation is correct. However, the kafka documentation as well as the KIP-848 will be updated to reflect the correct permission. We advise the Kafka users to review existing group ACLs to ensure the principle of least privilege.
Уязвимость реальзиации механизма авторизации API CONSUMER_GROUP_DESCRIBE диспетчера сообщений Apache Kafka, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации
EPSS
6.5 Medium
CVSS3