CVE-2024-31141 (GCVE-0-2024-31141)
Vulnerability from cvelistv5
Published
2024-11-19 08:40
Modified
2025-01-31 15:02
Severity ?
Summary
Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products. This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0. Users with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property "org.apache.kafka.automatic.config.providers=none". Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate "allowlist.pattern" and "allowed.paths" to restrict their operation to appropriate bounds. For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property. For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.
References
security@apache.orghttps://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2024/11/18/5
af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20250131-0001/
Impacted products
Vendor Product Version
Apache Software Foundation Apache Kafka Clients Version: 2.3.0   ≤ 3.5.2
Version: 3.6.0   ≤ 3.6.2
Version: 3.7.0   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2025-01-31T15:02:44.982Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  url: "http://www.openwall.com/lists/oss-security/2024/11/18/5",
               },
               {
                  url: "https://security.netapp.com/advisory/ntap-20250131-0001/",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  cvssV3_1: {
                     attackComplexity: "LOW",
                     attackVector: "NETWORK",
                     availabilityImpact: "NONE",
                     baseScore: 6.5,
                     baseSeverity: "MEDIUM",
                     confidentialityImpact: "HIGH",
                     integrityImpact: "NONE",
                     privilegesRequired: "LOW",
                     scope: "UNCHANGED",
                     userInteraction: "NONE",
                     vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
                     version: "3.1",
                  },
               },
               {
                  other: {
                     content: {
                        id: "CVE-2024-31141",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-19T14:14:13.118831Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-19T14:15:34.254Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               collectionURL: "https://repo.maven.apache.org/maven2",
               defaultStatus: "unaffected",
               packageName: "org.apache.kafka:kafka-clients",
               product: "Apache Kafka Clients",
               vendor: "Apache Software Foundation",
               versions: [
                  {
                     lessThanOrEqual: "3.5.2",
                     status: "affected",
                     version: "2.3.0",
                     versionType: "semver",
                  },
                  {
                     lessThanOrEqual: "3.6.2",
                     status: "affected",
                     version: "3.6.0",
                     versionType: "semver",
                  },
                  {
                     status: "affected",
                     version: "3.7.0",
                     versionType: "semver",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "Greg Harris",
            },
            {
               lang: "en",
               type: "remediation reviewer",
               value: "Mickael Maison",
            },
            {
               lang: "en",
               type: "remediation reviewer",
               value: "Chris Egerton",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.<br><br>Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.<br>In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.<br><br>In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.<br><p>This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.<br></p><p>Users with affected applications are recommended to upgrade kafka-clients to version &gt;=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".<br>Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.<br></p>For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.<br><span style=\"background-color: var(--wht);\">For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.<br></span>",
                  },
               ],
               value: "Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\n\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\n\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\n\n\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \"org.apache.kafka.automatic.config.providers=none\".\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \"allowlist.pattern\" and \"allowed.paths\" to restrict their operation to appropriate bounds.\n\n\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.",
            },
         ],
         metrics: [
            {
               other: {
                  content: {
                     text: "moderate",
                  },
                  type: "Textual description of severity",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-552",
                     description: "CWE-552 Files or Directories Accessible to External Parties",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-269",
                     description: "CWE-269 Improper Privilege Management",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-19T08:40:50.695Z",
            orgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
            shortName: "apache",
         },
         references: [
            {
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv",
            },
         ],
         source: {
            discovery: "INTERNAL",
         },
         title: "Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f0158376-9dc2-43b6-827c-5f631a4d8d09",
      assignerShortName: "apache",
      cveId: "CVE-2024-31141",
      datePublished: "2024-11-19T08:40:50.695Z",
      dateReserved: "2024-03-28T16:57:34.016Z",
      dateUpdated: "2025-01-31T15:02:44.982Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      fkie_nvd: {
         descriptions: "[{\"lang\": \"en\", \"value\": \"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\\n\\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\\n\\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\\n\\n\\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\\n\\n\\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\"}, {\"lang\": \"es\", \"value\": \"Archivos o directorios accesibles para terceros, vulnerabilidad de administraci\\u00f3n incorrecta de privilegios en clientes Apache Kafka. Los clientes Apache Kafka aceptan datos de configuraci\\u00f3n para personalizar el comportamiento e incluyen complementos ConfigProvider para manipular estas configuraciones. Apache Kafka tambi\\u00e9n proporciona implementaciones FileConfigProvider, DirectoryConfigProvider y EnvVarConfigProvider que incluyen la capacidad de leer desde el disco o variables de entorno. En aplicaciones donde las configuraciones de los clientes Apache Kafka pueden ser especificadas por un tercero que no es de confianza, los atacantes pueden usar estos ConfigProviders para leer contenido arbitrario del disco y las variables de entorno. En particular, esta falla puede usarse en Apache Kafka Connect para escalar desde el acceso a la API REST al acceso al sistema de archivos/entorno, lo que puede ser indeseable en ciertos entornos, incluidos los productos SaaS. Este problema afecta a los clientes Apache Kafka: desde 2.3.0 hasta 3.5.2, 3.6.2, 3.7.0. Se recomienda a los usuarios con aplicaciones afectadas que actualicen los clientes de Kafka a la versi\\u00f3n &gt;=3.8.0 y configuren la propiedad del sistema JVM \\\"org.apache.kafka.automatic.config.providers=none\\\". Tambi\\u00e9n se recomienda a los usuarios de Kafka Connect con una de las implementaciones de ConfigProvider enumeradas en la configuraci\\u00f3n de su trabajador que agreguen \\\"allowlist.pattern\\\" y \\\"allowed.paths\\\" adecuados para restringir su funcionamiento a los l\\u00edmites adecuados. Para los usuarios de Kafka Clients o Kafka Connect en entornos que conf\\u00edan a los usuarios el acceso a discos y variables de entorno, no se recomienda configurar la propiedad del sistema. Para los usuarios de Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams y las herramientas de l\\u00ednea de comandos de Kafka, no se recomienda configurar la propiedad del sistema.\"}]",
         id: "CVE-2024-31141",
         lastModified: "2024-11-21T09:12:54.913",
         metrics: "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 6.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 3.6}]}",
         published: "2024-11-19T09:15:03.860",
         references: "[{\"url\": \"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv\", \"source\": \"security@apache.org\"}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/11/18/5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
         sourceIdentifier: "security@apache.org",
         vulnStatus: "Awaiting Analysis",
         weaknesses: "[{\"source\": \"security@apache.org\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-269\"}, {\"lang\": \"en\", \"value\": \"CWE-552\"}]}]",
      },
      nvd: "{\"cve\":{\"id\":\"CVE-2024-31141\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-11-19T09:15:03.860\",\"lastModified\":\"2025-01-31T15:15:12.987\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\\n\\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\\n\\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\\n\\n\\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\\n\\n\\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\"},{\"lang\":\"es\",\"value\":\"Archivos o directorios accesibles para terceros, vulnerabilidad de administración incorrecta de privilegios en clientes Apache Kafka. Los clientes Apache Kafka aceptan datos de configuración para personalizar el comportamiento e incluyen complementos ConfigProvider para manipular estas configuraciones. Apache Kafka también proporciona implementaciones FileConfigProvider, DirectoryConfigProvider y EnvVarConfigProvider que incluyen la capacidad de leer desde el disco o variables de entorno. En aplicaciones donde las configuraciones de los clientes Apache Kafka pueden ser especificadas por un tercero que no es de confianza, los atacantes pueden usar estos ConfigProviders para leer contenido arbitrario del disco y las variables de entorno. En particular, esta falla puede usarse en Apache Kafka Connect para escalar desde el acceso a la API REST al acceso al sistema de archivos/entorno, lo que puede ser indeseable en ciertos entornos, incluidos los productos SaaS. Este problema afecta a los clientes Apache Kafka: desde 2.3.0 hasta 3.5.2, 3.6.2, 3.7.0. Se recomienda a los usuarios con aplicaciones afectadas que actualicen los clientes de Kafka a la versión &gt;=3.8.0 y configuren la propiedad del sistema JVM \\\"org.apache.kafka.automatic.config.providers=none\\\". También se recomienda a los usuarios de Kafka Connect con una de las implementaciones de ConfigProvider enumeradas en la configuración de su trabajador que agreguen \\\"allowlist.pattern\\\" y \\\"allowed.paths\\\" adecuados para restringir su funcionamiento a los límites adecuados. Para los usuarios de Kafka Clients o Kafka Connect en entornos que confían a los usuarios el acceso a discos y variables de entorno, no se recomienda configurar la propiedad del sistema. Para los usuarios de Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams y las herramientas de línea de comandos de Kafka, no se recomienda configurar la propiedad del sistema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"},{\"lang\":\"en\",\"value\":\"CWE-552\"}]}],\"references\":[{\"url\":\"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv\",\"source\":\"security@apache.org\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/11/18/5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.netapp.com/advisory/ntap-20250131-0001/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2024/11/18/5\"}, {\"url\": \"https://security.netapp.com/advisory/ntap-20250131-0001/\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-01-31T15:02:44.982Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-31141\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-19T14:14:13.118831Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-19T14:15:27.807Z\"}}], \"cna\": {\"title\": \"Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Greg Harris\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Mickael Maison\"}, {\"lang\": \"en\", \"type\": \"remediation reviewer\", \"value\": \"Chris Egerton\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache Kafka Clients\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.5.2\"}, {\"status\": \"affected\", \"version\": \"3.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"3.6.2\"}, {\"status\": \"affected\", \"version\": \"3.7.0\", \"versionType\": \"semver\"}], \"packageName\": \"org.apache.kafka:kafka-clients\", \"collectionURL\": \"https://repo.maven.apache.org/maven2\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/9whdzfr0zwdhr364604w5ssnzmg4v2lv\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.\\n\\nApache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.\\nIn applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.\\n\\nIn particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.\\nThis issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.\\n\\n\\nUsers with affected applications are recommended to upgrade kafka-clients to version >=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".\\nUsers of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.\\n\\n\\nFor users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.\\nFor users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients.<br><br>Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider implementations which include the ability to read from disk or environment variables.<br>In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use these ConfigProviders to read arbitrary contents of the disk and environment variables.<br><br>In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment access, which may be undesirable in certain environments, including SaaS products.<br><p>This issue affects Apache Kafka Clients: from 2.3.0 through 3.5.2, 3.6.2, 3.7.0.<br></p><p>Users with affected applications are recommended to upgrade kafka-clients to version &gt;=3.8.0, and set the JVM system property \\\"org.apache.kafka.automatic.config.providers=none\\\".<br>Users of Kafka Connect with one of the listed ConfigProvider implementations specified in their worker config are also recommended to add appropriate \\\"allowlist.pattern\\\" and \\\"allowed.paths\\\" to restrict their operation to appropriate bounds.<br></p>For users of Kafka Clients or Kafka Connect in environments that trust users with disk and environment variable access, it is not recommended to set the system property.<br><span style=\\\"background-color: var(--wht);\\\">For users of the Kafka Broker, Kafka MirrorMaker 2.0, Kafka Streams, and Kafka command-line tools, it is not recommended to set the system property.<br></span>\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-552\", \"description\": \"CWE-552 Files or Directories Accessible to External Parties\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-11-19T08:40:50.695Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-31141\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-31T15:02:44.982Z\", \"dateReserved\": \"2024-03-28T16:57:34.016Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2024-11-19T08:40:50.695Z\", \"assignerShortName\": \"apache\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.