Описание
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header.
Spring for Apache Kafka 4.1.0
Spring for Apache Kafka 4.0.0 - 4.0.6
Spring for Apache Kafka 3.0.0 - 3.3.16
Spring for Apache Kafka 2.9.0 - 2.9.14
Spring for Apache Kafka 2.8.12 and earlier
A flaw was found in Spring for Apache Kafka. The JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper components, which are used by default in @KafkaListener consumers, include java.net in their list of trusted packages. This allows a remote attacker, by sending a specially crafted message, to inject a java.net.InetAddress type through the spring_json_header_types message header. This can lead to Server-Side Request Forgery (SSRF) via DNS resolution, potentially enabling information disclosure or other network-based attacks.
Отчет
A flaw was found in Spring for Apache Kafka's header mapping functionality. The JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list, which is the default configuration for all @KafkaListener consumers. An external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Jackson's built-in InetAddress deserialization calls InetAddress.getByName(), which immediately triggers a DNS resolution. This Server-Side Request Forgery (SSRF) vulnerability could allow an attacker to perform DNS-based reconnaissance, access cloud metadata endpoints in containerized environments, or exfiltrate data via DNS queries. Red Hat ships vulnerable versions of Spring Kafka in JBoss Fuse 7 (Extended Lifecycle Support) and Subscription Services components. Fixed versions are available: 2.8.13+ for the 2.8.x line and 2.9.15+ for the 2.9.x line.
Меры по смягчению последствий
There is no mitigation available for this issue. Apply updates as they become available from Red Hat product teams. As a temporary workaround, configure custom header mappers that explicitly exclude java.net from the trusted packages list.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Fuse 7 | spring-kafka | Out of support scope |
Показывать по
Дополнительная информация
Статус:
EPSS
6.5 Medium
CVSS3
Связанные уязвимости
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper include java.net in their default trusted packages list. When these mappers are used — which is the default configuration for all @KafkaListener consumers — an external Kafka producer can inject a java.net.InetAddress type via the spring_json_header_types message header. Spring for Apache Kafka 4.1.0 Spring for Apache Kafka 4.0.0 - 4.0.6 Spring for Apache Kafka 3.0.0 - 3.3.16 Spring for Apache Kafka 2.9.0 - 2.9.14 Spring for Apache Kafka 2.8.12 and earlier
EPSS
6.5 Medium
CVSS3