Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)

[disclosure via Fulldisclosure <fulldisclosure () seclists org>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, 
Inc.). The research is published and a proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

Confluent Platform 7.9.1-ce exposes an unauthenticated remote code execution chain in its default configuration. ksqlDB 
(HTTP 8089), the Kafka broker (9092 PLAINTEXT, no SASL) and Kafka Connect (8083) all accept requests without 
authentication. An attacker submits a CREATE SINK CONNECTOR statement to ksqlDB using FileStreamSinkConnector with an 
attacker-controlled file path and StringConverter, then produces arbitrary bytes to the subscribed Kafka topic through 
the unauthenticated broker. The connector appends each message to the target file; writing a cron line to /etc/cron.d/ 
yields arbitrary command execution as root when crond runs. Dynamically verified with uid=0(root).

Impact: Arbitrary command execution as root (the ksqlDB/Connect process user); the attacker can read or destroy data on 
the host, persist access, and take full control of the Confluent deployment. No credentials are required.

Advisory: https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/