[HN Gopher] How to Get Remote Code Execution in Kafka UI
       ___________________________________________________________________
        
       How to Get Remote Code Execution in Kafka UI
        
       Author : jandeboevrie
       Score  : 44 points
       Date   : 2024-07-22 15:14 UTC (7 hours ago)
        
 (HTM) web link (github.blog)
 (TXT) w3m dump (github.blog)
        
       | snotrockets wrote:
       | To avoid confusion: all the described issues aren't with Apache
       | Kafka, but a separate piece of software called "Kafka UI" that is
       | a separate software to Apache Kafka, and isn't maintained or
       | distributed with it.
        
         | EdwardDiego wrote:
         | This is where Apache has gotten a bit touchy about project
         | naming using its trademarks in the past, AKHQ used to be
         | KafkaHQ, for example.
        
       | VoidWhisperer wrote:
       | > Similar to the previous issue, it took almost six months for
       | developers to implement a fix in version 0.7.2 of Kafka UI. They
       | fixed it by only updating the Apache Commons Collections library
       | to the newer version. While it prevents the second stage of the
       | gadget chain I shared above, the deserialization of untrusted
       | data still can occur.
       | 
       | This is concerning, that it took that long for it to be
       | addressed.. also, the changelog involving these issues doesn't
       | exactly inspire confidence because it has fixing the issues
       | marked as a 'chore'[0] - this could cause people to skip the
       | update if they skim it and see the only change was a 'chore'
       | change.
       | 
       | [0]: https://github.com/provectus/kafka-ui/releases/tag/v0.7.2
       | 
       | Edit: After taking a closer look, the long timeline for the fix
       | makes a little bit more sense - Provectus, the company behind
       | kafka-ui, made a point late last year that they are pausing or
       | otherwise stepping back from active development of the
       | project[1]. I still think that 6 months is a bit of a long time,
       | but with the additional context it seems less like security
       | neglience and more just the project not being anyones' focus.
       | 
       | [1]: https://github.com/provectus/kafka-ui/discussions/4255
        
       ___________________________________________________________________
       (page generated 2024-07-22 23:12 UTC)