CVE-2024-36543 STRIMZI incorrect access control
Attackers can bypass access controls in Kafka Connect to deny service, mirror data, or steal SASL credentials via the MirrorMaker REST API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-36543?
CVE-2024-36543 is a critical missing authorization vulnerability in n/a, published on 17 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Kafka Mirroring, potentially mirror the topics' content to his Kafka cluster via a malicious connector (bypassing Kafka ACL if it exists), and potentially steal Kafka SASL credentials, by querying the MirrorMaker Kafka REST API.
Weakness: CWE-400
Which versions are affected by CVE-2024-36543?
2 open source packages ship an affected version, including io.strimzi:strimzi.
| Package | Affected | Fixed in |
|---|---|---|
io.strimzi:strimzi Maven | All versions to 0.41.0 | None |
io.strimzi:strimzi Maven | All versions to 0.41.0 | None |
How do I fix CVE-2024-36543?
No fix has been published for CVE-2024-36543 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-36543 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-36543 exists.
Sources
Also known as GHSA-q2xx-f8r3-9mg5.