GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-31141 (GCVE-0-2024-31141)

Vulnerability from cvelistv5 – Published: 2024-11-19 08:40 – Updated: 2025-01-31 15:02
VLAI
Title
Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider
Summary
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property "org.apache.kafka.automatic.config.providers=none". Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate "allowlist.pattern" and "allowed.paths" to restrict their operation to appropriate bounds. For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property. For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.
Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-19 14:14 UTC
CWE
  • CWE-552 - Files or Directories Accessible to External Parties
  • CWE-269 - Improper Privilege Management
Assigner
References
Impacted products
Vendor Product Version CPE status
Apache Software Foundation Apache Kafka Clients Affected: 2.3.0 , ≤ 3.5.2 (semver)
Affected: 3.6.0 , ≤ 3.6.2 (semver)
Affected: 3.7.0 (semver)
guessed Create a notification for this product.
Credits
Greg Harris Mickael Maison Chris Egerton
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-01-31T15:02:44.982Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2024/11/18/5"
          },
          {
            "url": "https://security.netapp.com/advisory/ntap-20250131-0001/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-31141",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-19T14:14:13.118831Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-19T14:15:34.254Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.maven.apache.org/maven2",
          "defaultStatus": "unaffected",
          "packageName": "org.apache.kafka:kafka-clients",
          "product": "Apache Kafka Clients",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThanOrEqual": "3.5.2",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.6.2",
              "status": "affected",
              "version": "3.6.0",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Greg Harris"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Mickael Maison"
        },
        {
          "lang": "en",
          "type": "remediation reviewer",
          "value": "Chris Egerton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\u003cbr\u003e\u003cbr\u003eApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\u003cbr\u003eIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\u003cbr\u003e\u003cbr\u003eIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\u003cbr\u003e\u003cp\u003eThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers with affected applications are recommended to upgrade kafka-clients to version \u0026gt;=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".\u003cbr\u003eUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.\u003cbr\u003e\u003c/p\u003eFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\u003cbr\u003e\u003cspan style=\"background-color: var(--wht);\"\u003eFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\u003cbr\u003e\u003c/span\u003e"
            }
          ],
          "value": "Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\n\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\n\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\n\n\nUsers with affected applications are recommended to upgrade kafka-clients to version \u003e=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.\n\n\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "moderate"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "CWE-552 Files or Directories Accessible to External Parties",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-11-19T08:40:50.695Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv"
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-31141",
    "datePublished": "2024-11-19T08:40:50.695Z",
    "dateReserved": "2024-03-28T16:57:34.016Z",
    "dateUpdated": "2025-01-31T15:02:44.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-31141",
      "date": "2026-09-17",
      "epss": "0.0124",
      "percentile": "0.67693"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\\n\\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\\n\\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\\n\\n\\nUsers with affected applications are recommended to upgrade kafka-clients to version \u003e=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\\n\\n\\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\"}, {\"lang\": \"es\", \"value\": \"Archivos o directorios accesibles para terceros, vulnerabilidad de administraci\\u00f3n incorrecta de privilegios en clientes Apache Kafka. Los clientes Apache Kafka aceptan datos de configuraci\\u00f3n para personalizar el comportamiento e incluyen complementos ConfigProvider para manipular estas configuraciones. Apache Kafka tambi\\u00e9n proporciona implementaciones FileConfigProvider, DirectoryConfigProvider y EnvVarConfigProvider que incluyen la capacidad de leer desde el disco o variables de entorno. En aplicaciones donde las configuraciones de los clientes Apache Kafka pueden ser especificadas por un tercero que no es de confianza, los atacantes pueden usar estos ConfigProviders para leer contenido arbitrario del disco y las variables de entorno. En particular, esta falla puede usarse en Apache Kafka Connect para escalar desde el acceso a la API REST al acceso al sistema de archivos/entorno, lo que puede ser indeseable en ciertos entornos, incluidos los productos SaaS. Este problema afecta a los clientes Apache Kafka: desde 2.3.0 hasta 3.5.2, 3.6.2, 3.7.0. Se recomienda a los usuarios con aplicaciones afectadas que actualicen los clientes de Kafka a la versi\\u00f3n \u0026gt;=3.8.0 y configuren la propiedad del sistema JVM \\\"org.apache.kafka.automatic.config.providers=none\\\". Tambi\\u00e9n se recomienda a los usuarios de Kafka Connect con una de las implementaciones de ConfigProvider enumeradas en la configuraci\\u00f3n de su trabajador que agreguen \\\"allowlist.pattern\\\" y \\\"allowed.paths\\\" adecuados para restringir su funcionamiento a los l\\u00edmites adecuados. Para los usuarios de Kafka Clients o Kafka Connect en entornos que conf\\u00edan a los usuarios el acceso a discos y variables de entorno, no se recomienda configurar la propiedad del sistema. Para los usuarios de Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams y las herramientas de l\\u00ednea de comandos de Kafka, no se recomienda configurar la propiedad del sistema.\"}]",
      "id": "CVE-2024-31141",
      "lastModified": "2024-11-21T09:12:54.913",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-19T09:15:03.860",
      "references": "[{\"url\": \"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv\", \"source\": \"security@apache.org\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/11/18/5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-269\"}, {\"lang\": \"en\", \"value\": \"CWE-552\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-31141\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-11-19T09:15:03.860\",\"lastModified\":\"2026-06-17T07:27:51.423\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\\n\\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\\n\\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\\n\\n\\nUsers with affected applications are recommended to upgrade kafka-clients to version \u003e=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\\n\\n\\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\"},{\"lang\":\"es\",\"value\":\"Archivos o directorios accesibles para terceros, vulnerabilidad de administraci\u00f3n incorrecta de privilegios en clientes Apache Kafka. Los clientes Apache Kafka aceptan datos de configuraci\u00f3n para personalizar el comportamiento e incluyen complementos ConfigProvider para manipular estas configuraciones. Apache Kafka tambi\u00e9n proporciona implementaciones FileConfigProvider, DirectoryConfigProvider y EnvVarConfigProvider que incluyen la capacidad de leer desde el disco o variables de entorno. En aplicaciones donde las configuraciones de los clientes Apache Kafka pueden ser especificadas por un tercero que no es de confianza, los atacantes pueden usar estos ConfigProviders para leer contenido arbitrario del disco y las variables de entorno. En particular, esta falla puede usarse en Apache Kafka Connect para escalar desde el acceso a la API REST al acceso al sistema de archivos/entorno, lo que puede ser indeseable en ciertos entornos, incluidos los productos SaaS. Este problema afecta a los clientes Apache Kafka: desde 2.3.0 hasta 3.5.2, 3.6.2, 3.7.0. Se recomienda a los usuarios con aplicaciones afectadas que actualicen los clientes de Kafka a la versi\u00f3n \u0026gt;=3.8.0 y configuren la propiedad del sistema JVM \\\"org.apache.kafka.automatic.config.providers=none\\\". Tambi\u00e9n se recomienda a los usuarios de Kafka Connect con una de las implementaciones de ConfigProvider enumeradas en la configuraci\u00f3n de su trabajador que agreguen \\\"allowlist.pattern\\\" y \\\"allowed.paths\\\" adecuados para restringir su funcionamiento a los l\u00edmites adecuados. Para los usuarios de Kafka Clients o Kafka Connect en entornos que conf\u00edan a los usuarios el acceso a discos y variables de entorno, no se recomienda configurar la propiedad del sistema. Para los usuarios de Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams y las herramientas de l\u00ednea de comandos de Kafka, no se recomienda configurar la propiedad del sistema.\"}],\"affected\":[{\"source\":\"security@apache.org\",\"affectedData\":[{\"vendor\":\"Apache Software Foundation\",\"product\":\"Apache Kafka Clients\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://repo.maven.apache.org/maven2\",\"packageName\":\"org.apache.kafka:kafka-clients\",\"versions\":[{\"version\":\"2.3.0\",\"lessThanOrEqual\":\"3.5.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.6.0\",\"lessThanOrEqual\":\"3.6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.7.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-11-19T14:14:13.118831Z\",\"id\":\"CVE-2024-31141\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"},{\"lang\":\"en\",\"value\":\"CWE-552\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.3.0\",\"versionEndIncluding\":\"3.5.2\",\"matchCriteriaId\":\"1447B938-5E30-41D0-B541-E41BBC9D6A1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kafka:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndIncluding\":\"3.6.2\",\"matchCriteriaId\":\"90EFBD89-C965-46CC-BB28-A11EE7C94C9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:kafka:3.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3FCE14A-5AAE-4BD0-BF61-6EDFCF3F1723\"}]}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/11/18/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20250131-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T20:03:38+00:00",
      "cve": "CVE-2024-31141",
      "id": "CVE-2024-31141",
      "initial_release_date": "2024-11-19T08:40:50.695000+00:00",
      "product_status:fixed": "4",
      "product_status:known_affected": "11",
      "product_status:known_not_affected": "6",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-31141.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/11/18/5\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250131-0001/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-01-31T15:02:44.982Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-31141\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-19T14:14:13.118831Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-19T14:15:27.807Z\"}}], \"cna\": {\"title\": \"Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Greg Harris\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Mickael Maison\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Chris Egerton\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Kafka Clients\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.5.2\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.6.2\"}, {\"status\": \"affected\", \"version\": \"3.7.0\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.kafka:kafka-clients\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\\n\\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\\n\\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\\n\\n\\nUsers with affected applications are recommended to upgrade kafka-clients to version \u003e=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\\n\\n\\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\u003cbr\u003e\u003cbr\u003eApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\u003cbr\u003eIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\u003cbr\u003e\u003cbr\u003eIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\u003cbr\u003e\u003cp\u003eThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\u003cbr\u003e\u003c/p\u003e\u003cp\u003eUsers with affected applications are recommended to upgrade kafka-clients to version \u0026gt;=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\u003cbr\u003eUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\u003cbr\u003e\u003c/p\u003eFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\u003cbr\u003e\u003cspan style=\\\"background-color: var(--wht);\\\"\u003eFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\u003cbr\u003e\u003c/span\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-552\", \"description\": \"CWE-552 Files or Directories Accessible to External Parties\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-11-19T08:40:50.695Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-31141\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-31T15:02:44.982Z\", \"dateReserved\": \"2024-03-28T16:57:34.016Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2024-11-19T08:40:50.695Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.