Security-Sensitive Key Exposure in StreamsHub Console for Apache Kafka

Executive Summary

This vulnerability involves Apache Kafka's StreamsHub Console. It allows a tenant to inject Kafka client properties into the console-api AdminClient configuration without filtering sensitive keys. This could let an attacker exfiltrate the console-api ServiceAccount token to a malicious Kafka broker by manipulating config.providers and bootstrap.servers settings.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized exfiltration attempts of the console-api ServiceAccount token. Check Kubernetes audit logs for Console CR modifications with suspicious Kafka client properties like config.providers or bootstrap.servers pointing to external brokers. Inspect network traffic from console-api pods to unexpected destinations using tools like tcpdump or Wireshark.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this flaw could allow unauthorized access to sensitive data or operations within the Kafka environment. An attacker could gain control over the console-api ServiceAccount token, potentially leading to data breaches or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR or HIPAA. It may result in data breaches, unauthorized data exposure, or loss of control over access logs, potentially leading to legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Review and filter security-sensitive Kafka client properties in the StreamsHub Console custom resource to prevent unauthorized AdminClient configuration changes. Ensure console-api ServiceAccount tokens are not exposed to untrusted Kafka brokers.

Useful 0 Not Useful 0