[HN Gopher] How to Get Remote Code Execution in Kafka UI
___________________________________________________________________
How to Get Remote Code Execution in Kafka UI
Author : jandeboevrie
Score : 44 points
Date : 2024-07-22 15:14 UTC (7 hours ago)
(HTM) web link (github.blog)
(TXT) w3m dump (github.blog)
| snotrockets wrote:
| To avoid confusion: all the described issues aren't with Apache
| Kafka, but a separate piece of software called "Kafka UI" that is
| a separate software to Apache Kafka, and isn't maintained or
| distributed with it.
| EdwardDiego wrote:
| This is where Apache has gotten a bit touchy about project
| naming using its trademarks in the past, AKHQ used to be
| KafkaHQ, for example.
| VoidWhisperer wrote:
| > Similar to the previous issue, it took almost six months for
| developers to implement a fix in version 0.7.2 of Kafka UI. They
| fixed it by only updating the Apache Commons Collections library
| to the newer version. While it prevents the second stage of the
| gadget chain I shared above, the deserialization of untrusted
| data still can occur.
|
| This is concerning, that it took that long for it to be
| addressed.. also, the changelog involving these issues doesn't
| exactly inspire confidence because it has fixing the issues
| marked as a 'chore'[0] - this could cause people to skip the
| update if they skim it and see the only change was a 'chore'
| change.
|
| [0]: https://github.com/provectus/kafka-ui/releases/tag/v0.7.2
|
| Edit: After taking a closer look, the long timeline for the fix
| makes a little bit more sense - Provectus, the company behind
| kafka-ui, made a point late last year that they are pausing or
| otherwise stepping back from active development of the
| project[1]. I still think that 6 months is a bit of a long time,
| but with the additional context it seems less like security
| neglience and more just the project not being anyones' focus.
|
| [1]: https://github.com/provectus/kafka-ui/discussions/4255
___________________________________________________________________
(page generated 2024-07-22 23:12 UTC)