Kroxylicious: missing upstream kafka tls hostname verification
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 0.80.0, 0.8.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
A flaw was found in Kroxylicious. When establishing the connection with the upstream Kafka server using a TLS secured connection, Kroxylicious fails to properly verify the server's hostname, resulting in an insecure connection. For a successful attack to be performed, the attacker needs to perform a Man-in-the-Middle attack or compromise any external systems, such as DNS or network routing configuration. This issue is considered a high complexity attack, with additional high privileges required, as the attack would need access to the Kroxylicious configuration or a peer system. The result of a successful attack impacts both data integrity and confidentiality.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- kroxylicious
From 0.80.0 · fixed in 0.80.0
- io.kroxylicious-kroxylicious-parent
Version range not reported
- io.kroxylicious/kroxylicious-annotations
Version range not reported
- io.kroxylicious/kroxylicious-api
Version range not reported
- io.kroxylicious/kroxylicious-app
Version range not reported
- io.kroxylicious/kroxylicious-app-licenses
Version range not reported
- io.kroxylicious/kroxylicious-filter-test-support
Version range not reported
- io.kroxylicious/kroxylicious-integration-test-support
Version range not reported
- io.kroxylicious/kroxylicious-kms
Version range not reported
- io.kroxylicious/kroxylicious-kms-provider-hashicorp-vault
Version range not reported
- io.kroxylicious/kroxylicious-kms-provider-hashicorp-vault-test-support
Version range not reported
- io.kroxylicious/kroxylicious-kms-provider-kroxylicious-inmemory
Version range not reported
- io.kroxylicious/kroxylicious-kms-provider-kroxylicious-inmemory-test-support
Version range not reported
- io.kroxylicious/kroxylicious-kms-test-support
Version range not reported
- io.kroxylicious/kroxylicious-krpc-plugin
Version range not reported
- io.kroxylicious/kroxylicious-multitenant
Version range not reported
- io.kroxylicious/kroxylicious-record-encryption
Version range not reported
- io.kroxylicious/kroxylicious-record-validation
Version range not reported
- io.kroxylicious/kroxylicious-runtime
Version range not reported
- io.kroxylicious/kroxylicious-sample
Version range not reported
- io.kroxylicious/kroxylicious-simple-transform
Version range not reported
- io.kroxylicious.testing/testing-api
Version range not reported
- io.kroxylicious.testing/testing-impl
Version range not reported
- io.kroxylicious.testing/testing-junit5-extension
Version range not reported
- io.kroxylicious:kroxylicious-runtimeMaven
fixed in 0.8.0