[FD] Security advisory: Pre-authentication RCE in Confluent Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.)

[disclosure via Fulldisclosure <fulldisclosure@xxxxxxxxxxxx>]

0day Rubbish Research Team is publicly disclosing a vulnerability in Confluent 
Platform (ksqlDB) 7.9.1-ce (Confluent, Inc.). The research is published and a 
proof-of-concept is available.

Pre-authentication RCE (CVSS 9.8, pre-authentication)

Confluent Platform 7.9.1-ce exposes an unauthenticated remote code execution 
chain in its default configuration. ksqlDB (HTTP 8089), the Kafka broker (9092 
PLAINTEXT, no SASL) and Kafka Connect (8083) all accept requests without 
authentication. An attacker submits a CREATE SINK CONNECTOR statement to ksqlDB 
using FileStreamSinkConnector with an attacker-controlled file path and 
StringConverter, then produces arbitrary bytes to the subscribed Kafka topic 
through the unauthenticated broker. The connector appends each message to the 
target file; writing a cron line to /etc/cron.d/ yields arbitrary command 
execution as root when crond runs. Dynamically verified with uid=0(root).

Impact: Arbitrary command execution as root (the ksqlDB/Connect process user); 
the attacker can read or destroy data on the host, persist access, and take 
full control of the Confluent deployment. No credentials are required.

Advisory: https://0day-rubbish.com/blog/ksqldb-unauth-sink-connector-cron-rce

PoC and full analysis: https://github.com/Exploit-Garbage/0day-Rubbish

-- 
0day Rubbish Research Team
https://0day-rubbish.com
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/