Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-52hy-npa4-h7fz
Summary
Deserialization of Untrusted Data
A possible security vulnerability has been identified in Apache Kafka Connect. This requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka 2.3.0. When configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config` property for any of the connector's Kafka clients to "com.sun.security.auth.module.JndiLoginModule", which can be done via the `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties. This will allow the server to connect to the attacker's LDAP server and deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server. Attacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath. Since Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box configurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector client override policy that permits them. Since Apache Kafka 3.4.0, we have added a system property ("-Dorg.apache.kafka.disallowed.login.modules") to disable the problematic login modules usage in SASL JAAS configuration. Also by default "com.sun.security.auth.module.JndiLoginModule" is disabled in Apache Kafka 3.4.0. We advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for vulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally, in addition to leveraging the "org.apache.kafka.disallowed.login.modules" system property, Kafka Connect users can also implement their own connector client config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.
Aliases
0
alias CVE-2023-25194
1
alias GHSA-26f8-x7cc-wqpc
Fixed_packages
0
url pkg:maven/org.apache.kafka/connect@3.4.0
purl pkg:maven/org.apache.kafka/connect@3.4.0
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.4.0
Affected_packages
0
url pkg:maven/org.apache.kafka/connect@2.3.0
purl pkg:maven/org.apache.kafka/connect@2.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.3.0
1
url pkg:maven/org.apache.kafka/connect@2.6.0
purl pkg:maven/org.apache.kafka/connect@2.6.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.6.0
2
url pkg:maven/org.apache.kafka/connect@2.6.1
purl pkg:maven/org.apache.kafka/connect@2.6.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.6.1
3
url pkg:maven/org.apache.kafka/connect@2.6.2
purl pkg:maven/org.apache.kafka/connect@2.6.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.6.2
4
url pkg:maven/org.apache.kafka/connect@2.6.3
purl pkg:maven/org.apache.kafka/connect@2.6.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.6.3
5
url pkg:maven/org.apache.kafka/connect@2.7.0
purl pkg:maven/org.apache.kafka/connect@2.7.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.7.0
6
url pkg:maven/org.apache.kafka/connect@2.7.1
purl pkg:maven/org.apache.kafka/connect@2.7.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.7.1
7
url pkg:maven/org.apache.kafka/connect@2.7.2
purl pkg:maven/org.apache.kafka/connect@2.7.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.7.2
8
url pkg:maven/org.apache.kafka/connect@2.8.0
purl pkg:maven/org.apache.kafka/connect@2.8.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.8.0
9
url pkg:maven/org.apache.kafka/connect@2.8.1
purl pkg:maven/org.apache.kafka/connect@2.8.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.8.1
10
url pkg:maven/org.apache.kafka/connect@2.8.2
purl pkg:maven/org.apache.kafka/connect@2.8.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@2.8.2
11
url pkg:maven/org.apache.kafka/connect@3.0.0
purl pkg:maven/org.apache.kafka/connect@3.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.0.0
12
url pkg:maven/org.apache.kafka/connect@3.0.1
purl pkg:maven/org.apache.kafka/connect@3.0.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.0.1
13
url pkg:maven/org.apache.kafka/connect@3.0.2
purl pkg:maven/org.apache.kafka/connect@3.0.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.0.2
14
url pkg:maven/org.apache.kafka/connect@3.1.0
purl pkg:maven/org.apache.kafka/connect@3.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.1.0
15
url pkg:maven/org.apache.kafka/connect@3.1.1
purl pkg:maven/org.apache.kafka/connect@3.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.1.1
16
url pkg:maven/org.apache.kafka/connect@3.1.2
purl pkg:maven/org.apache.kafka/connect@3.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.1.2
17
url pkg:maven/org.apache.kafka/connect@3.2.0
purl pkg:maven/org.apache.kafka/connect@3.2.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.2.0
18
url pkg:maven/org.apache.kafka/connect@3.2.1
purl pkg:maven/org.apache.kafka/connect@3.2.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.2.1
19
url pkg:maven/org.apache.kafka/connect@3.2.2
purl pkg:maven/org.apache.kafka/connect@3.2.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.2.2
20
url pkg:maven/org.apache.kafka/connect@3.2.3
purl pkg:maven/org.apache.kafka/connect@3.2.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.2.3
21
url pkg:maven/org.apache.kafka/connect@3.3.0
purl pkg:maven/org.apache.kafka/connect@3.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.3.0
22
url pkg:maven/org.apache.kafka/connect@3.3.1
purl pkg:maven/org.apache.kafka/connect@3.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.3.1
23
url pkg:maven/org.apache.kafka/connect@3.3.2
purl pkg:maven/org.apache.kafka/connect@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/connect@3.3.2
24
url pkg:maven/org.apache.kafka/kafka@2.3.0
purl pkg:maven/org.apache.kafka/kafka@2.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
1
vulnerability VCID-54g2-u5g6-x7gr
2
vulnerability VCID-qepc-2rn8-hufs
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/kafka@2.3.0
25
url pkg:maven/org.apache.kafka/kafka@3.3.2
purl pkg:maven/org.apache.kafka/kafka@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/kafka@3.3.2
26
url pkg:maven/org.apache.kafka/kafka_2.10@2.3.0
purl pkg:maven/org.apache.kafka/kafka_2.10@2.3.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/kafka_2.10@2.3.0
27
url pkg:maven/org.apache.kafka/kafka_2.10@3.3.2
purl pkg:maven/org.apache.kafka/kafka_2.10@3.3.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-52hy-npa4-h7fz
resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.kafka/kafka_2.10@3.3.2
References
0
reference_url http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-25T14:12:44Z/
url http://packetstormsecurity.com/files/173151/Apache-Druid-JNDI-Injection-Remote-Code-Execution.html
1
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25194.json
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-25194.json
2
reference_url https://api.first.org/data/v1/epss?cve=CVE-2023-25194
reference_id
reference_type
scores
0
value 0.94055
scoring_system epss
scoring_elements 0.99904
published_at 2026-04-18T12:55:00Z
1
value 0.94055
scoring_system epss
scoring_elements 0.99901
published_at 2026-04-04T12:55:00Z
2
value 0.94055
scoring_system epss
scoring_elements 0.99902
published_at 2026-04-12T12:55:00Z
3
value 0.94055
scoring_system epss
scoring_elements 0.99903
published_at 2026-04-26T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2023-25194
3
reference_url https://github.com/apache/kafka
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/apache/kafka
4
reference_url https://hackerone.com/reports/1529790
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://hackerone.com/reports/1529790
5
reference_url https://kafka.apache.org/cve-list
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-25T14:12:44Z/
url https://kafka.apache.org/cve-list
6
reference_url https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
2
value Track*
scoring_system ssvc
scoring_elements SSVCv2/E:P/A:N/T:T/P:M/B:A/M:M/D:R/2025-03-25T14:12:44Z/
url https://lists.apache.org/thread/vy1c7fqcdqvq5grcqp6q5jyyb302khyz
7
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2216516
reference_id 2216516
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2216516
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2023-25194
reference_id CVE-2023-25194
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2023-25194
9
reference_url https://github.com/advisories/GHSA-26f8-x7cc-wqpc
reference_id GHSA-26f8-x7cc-wqpc
reference_type
scores
0
value HIGH
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-26f8-x7cc-wqpc
10
reference_url https://access.redhat.com/errata/RHSA-2023:1241
reference_id RHSA-2023:1241
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:1241
11
reference_url https://access.redhat.com/errata/RHSA-2023:3223
reference_id RHSA-2023:3223
reference_type
scores
url https://access.redhat.com/errata/RHSA-2023:3223
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 502
name Deserialization of Untrusted Data
description The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
0
date_added null
description 
This module is designed to exploit the JNDI injection vulnerability
        in Druid. The vulnerability specifically affects the indexer/v1/sampler
        interface of Druid, enabling an attacker to execute arbitrary commands
        on the targeted server.

        The vulnerability is found in Apache Kafka clients versions ranging from
        2.3.0 to 3.3.2. If an attacker can manipulate the sasl.jaas.config
        property of any of the connector's Kafka clients to com.sun.security.auth.module.JndiLoginModule,
        it allows the server to establish a connection with the attacker's LDAP server
        and deserialize the LDAP response. This provides the attacker with the capability
        to execute java deserialization gadget chains on the Kafka connect server,
        potentially leading to unrestricted deserialization of untrusted data or even
        remote code execution (RCE) if there are relevant gadgets in the classpath.

        To facilitate the exploitation process, this module will initiate an LDAP server
        that the target server needs to connect to in order to carry out the attack.
required_action null
due_date null
notes 
Stability:
  - crash-safe
SideEffects:
  - ioc-in-logs
Reliability:
  - repeatable-session
known_ransomware_campaign_use false
source_date_published 2023-02-07
exploit_type null
platform Unix,Windows
source_date_updated null
data_source Metasploit
source_url https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/multi/http/apache_druid_cve_2023_25194.rb
Severity_range_score7.0 - 8.9
Exploitability2.0
Weighted_severity8.0
Risk_score10.0
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-52hy-npa4-h7fz