CVE-2023-25194

What it actually does

This flaw allows an authenticated user who can create or modify Kafka Connect connectors to supply malicious Kafka client SASL JAAS configuration through connector override properties such as producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config. By setting the login module to com.sun.security.auth.module.JndiLoginModule and pointing it to an attacker-controlled LDAP endpoint, the Kafka Connect worker can be forced to perform a JNDI lookup and deserialize untrusted LDAP response data. If suitable Java deserialization gadget classes are present in the worker or connector classpath, this can result in remote code execution with the privileges of the Kafka Connect worker process. Even without a working gadget chain, the behavior can enable outbound callback, credential exposure, denial of service, or unsafe interaction with attacker-controlled infrastructure.

Why it matters to the business

A compromised Kafka Connect worker can affect data pipelines that move information between Kafka and downstream systems. Successful exploitation may let an attacker run commands on integration infrastructure, steal secrets available to connectors, alter or disrupt data flows, access connected databases or services, and use the worker as a foothold for broader lateral movement. The risk is elevated because exploitation is weaponized, the EPSS score is very high, and many Kafka Connect deployments allow connector configuration through REST APIs used by operators and automation. Although it is not currently listed in CISA KEV and is not marked as ransomware-used, the maturity and age of public exploitation make exposed or weakly governed Connect clusters a high-priority remediation target.

How an attack unfolds

An attacker first obtains credentials or API access for an identity allowed to create or update Kafka Connect connector configurations. The attacker submits a connector configuration through the Kafka Connect REST API that enables a SASL-based security protocol and injects a JAAS override using one of the connector client override properties. The malicious value specifies com.sun.security.auth.module.JndiLoginModule and references an attacker-controlled LDAP server. When the Kafka Connect worker initializes or reconfigures the connector client, it evaluates the supplied login module, performs an outbound JNDI/LDAP connection, and processes the LDAP response. If a compatible deserialization gadget chain exists in the worker or connector dependencies, the attacker’s LDAP response triggers code execution inside the Kafka Connect JVM. The attacker can then execute commands, deploy persistence, read connector secrets, manipulate data movement, or pivot to services reachable from the worker.

How to fix it

Upgrade Apache Kafka Connect to a fixed/safe version where the problematic login module is blocked by default; Apache Kafka 3.4.0 and later disable com.sun.security.auth.module.JndiLoginModule by default for this use case. Where immediate upgrade is not possible, start Kafka Connect with the system property -Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule and include any other untrusted login modules that should be blocked. Enforce a connector client config override policy that prevents connector configurations from setting producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, admin.override.sasl.jaas.config, and other sensitive Kafka client security properties unless explicitly required and trusted. Restrict the Kafka Connect REST API to trusted administrative networks and identities, require strong authentication and authorization, and audit who can create or modify connectors. Review connector plugin dependencies for known Java deserialization gadget libraries and remove or upgrade risky dependencies. Validate existing connector configurations and remove any untrusted JNDI, LDAP, RMI, or arbitrary JAAS login module settings. If consuming affected code through mlflow/mlflow from Git as indicated by the supplied package metadata, update to commit ffe005c58dd45e4f200bfb5a77aa5273a57ca39d or later in addition to remediating Kafka Connect deployments directly.

How to confirm the fix worked

Confirm the Kafka Connect runtime version and verify that it is Apache Kafka 3.4.0 or later, or that the worker JVM includes -Dorg.apache.kafka.disallowed.login.modules with com.sun.security.auth.module.JndiLoginModule listed. Query all connector configurations through the Kafka Connect REST API and confirm that producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, and admin.override.sasl.jaas.config are absent or contain only explicitly approved login modules and destinations. Attempt to create or validate a test connector using com.sun.security.auth.module.JndiLoginModule in a non-production environment and confirm the configuration is rejected. Review connector client override policy settings to ensure sensitive security properties cannot be overridden by ordinary connector definitions. Validate network controls by confirming Kafka Connect workers cannot initiate outbound LDAP/RMI connections to unapproved destinations. If using the supplied Git-based affected package metadata, confirm the deployed mlflow/mlflow source includes commit ffe005c58dd45e4f200bfb5a77aa5273a57ca39d or a later equivalent fix.

Typical attack path

1. Identify a reachable Kafka Connect REST API or automation path that permits connector creation or modification.
2. Authenticate as, compromise, or abuse an operator/service identity with connector configuration privileges.
3. Create or update a connector using a SASL-based Kafka client security protocol.
4. Set producer.override.sasl.jaas.config, consumer.override.sasl.jaas.config, or admin.override.sasl.jaas.config to use com.sun.security.auth.module.JndiLoginModule.
5. Point the JNDI configuration to an attacker-controlled LDAP endpoint.
6. Trigger connector startup, task restart, validation, or reconfiguration so the Kafka Connect worker evaluates the malicious JAAS setting.
7. Deliver an LDAP response that causes unsafe Java deserialization when compatible gadget classes are present.
8. Execute code in the Kafka Connect worker process, then access secrets, alter pipelines, disrupt availability, or move laterally.

How to detect it

Review Kafka Connect REST API access logs, reverse proxy logs, authentication/audit logs, and application logs for connector create, update, validate, restart, or task restart events containing suspicious JAAS override properties. Search all current and historical connector configurations for com.sun.security.auth.module.JndiLoginModule, ldap://, ldaps://, rmi://, and any unapproved sasl.jaas.config values. Correlate suspicious configuration changes with outbound network connections from Kafka Connect workers to LDAP, LDAPS, RMI, HTTP, or unusual high ports, especially to internet destinations. Inspect Kafka Connect worker logs for connector reconfiguration events, failed SASL authentication, JNDI exceptions, LDAP connection errors, class loading errors, deserialization exceptions, unexpected process execution, or JVM crashes after connector updates. On hosts, review process creation telemetry for shell, scripting, download, or reconnaissance commands spawned by the Kafka Connect Java process. Examine connector plugin directories for newly added JARs or modified dependencies around the time of suspicious connector updates. If exploitation is suspected, preserve connector configs, REST API logs, worker logs, JVM command line, plugin directory listings, network flow records, and endpoint telemetry before restarting or rebuilding workers.

• com.sun.security.auth.module.JndiLoginModule
• producer.override.sasl.jaas.config
• consumer.override.sasl.jaas.config
• admin.override.sasl.jaas.config
• sasl.jaas.config
• java.naming.provider.url
• java.naming.factory.initial
• ldap://
• ldaps://
• rmi://
• /connectors
• /connectors/
• /config
• /connector-plugins/
• PUT /connectors/
• POST /connectors
• POST /connector-plugins/
• org.apache.kafka.disallowed.login.modules
• javax.naming.NamingException
• javax.naming.CommunicationException
• Cannot connect to LDAP server
• JndiLoginModule
• Unrestricted deserialization
• InvalidClassException
• readObject
• ysoserial
• bash -c
• sh -c
• curl
• wget
• nc
• ncat
• /bin/bash
• /bin/sh

What your security team should do

• Treat any Kafka Connect REST API that permits connector modification as a privileged administrative interface; remove public exposure and restrict access immediately.
• Upgrade Kafka Connect to Apache Kafka 3.4.0 or later, or deploy -Dorg.apache.kafka.disallowed.login.modules=com.sun.security.auth.module.JndiLoginModule as an urgent compensating control.
• Inventory all Kafka Connect clusters and export all connector configurations for review of JAAS override properties, JNDI login modules, and LDAP/RMI URLs.
• Implement or tighten connector client override policies so connector authors cannot override sensitive Kafka client authentication properties by default.
• Search historical Kafka Connect REST, audit, application, proxy, and network logs for malicious connector updates and outbound LDAP/RMI callbacks from worker hosts.
• Rotate secrets accessible to Kafka Connect workers if suspicious connector configuration or outbound callbacks are found.
• Remove unnecessary connector plugins and upgrade connector dependencies that may provide Java deserialization gadget chains.
• Add SIEM detections for JndiLoginModule, sasl.jaas.config override properties, and outbound LDAP/RMI traffic from Kafka Connect workers.
• If using mlflow/mlflow from Git per the supplied package metadata, update to commit ffe005c58dd45e4f200bfb5a77aa5273a57ca39d or later.
• Prioritize remediation despite the absence of KEV status because public exploitation is weaponized and the EPSS likelihood is very high.