CVE-2025-27818
BaseFortify
Publication date: 2025-06-10
Last updated on: 2025-07-11
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | kafka | From 2.3.0 (inc) to 3.9.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-27818 is a security vulnerability in Apache Kafka versions 2.3.0 through 3.9.0 that allows an authenticated operator with permissions to alter cluster resource configurations or Kafka Connect worker settings to set the 'sasl.jaas.config' property in connector configurations to use the 'com.sun.security.auth.module.LdapLoginModule'. This causes the Kafka Connect server to connect to an attacker-controlled LDAP server and deserialize the LDAP response. If the classpath contains Java deserialization gadgets, this can lead to unrestricted deserialization of untrusted data and enable remote code execution (RCE) on the Kafka Connect server. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker who has authenticated access and the ability to modify connector configurations to execute arbitrary code remotely on the Kafka Connect server. This can lead to full compromise of the server running Kafka Connect, potentially allowing data theft, service disruption, or further attacks within the network. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves auditing Kafka Connect cluster configurations and connector settings for the presence of the `sasl.jaas.config` property set to use `com.sun.security.auth.module.LdapLoginModule` or `com.sun.security.auth.module.JndiLoginModule`. You should check connector configurations for properties such as `producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` that specify these login modules. Commands to inspect connector configurations via Kafka Connect REST API or configuration files can be used. For example, using curl to query connector configs: `curl -X GET http://<kafka-connect-host>:8083/connectors/<connector-name>/config` and then searching for these properties. Additionally, reviewing broker and connector logs for unexpected LDAP connections or deserialization errors may help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1) Validating and restricting connector configurations to disallow untrusted or arbitrary LDAP configurations, especially disallowing the use of `com.sun.security.auth.module.LdapLoginModule` and `JndiLoginModule` in `sasl.jaas.config` properties. 2) Upgrading Apache Kafka to version 3.9.1 or later, where the system property `-Dorg.apache.kafka.disallowed.login.modules` disables these problematic login modules by default. 3) Implementing a custom connector client configuration override policy to control which Kafka client properties can be overridden in connector configurations. 4) Auditing and upgrading or removing vulnerable connectors and their dependencies. These steps reduce the risk of remote code execution via this vulnerability. [1]