kafka-ui vulnerabilities

Kafka UI, an open-source web UI for Apache Kafka management, allows users to connect to different Kafka brokers and monitor their performance via JMX ports. JMX is based on the RMI protocol, which is inherently susceptible to deserialization attacks. An attacker can exploit this feature by connecting the Kafka UI backend to a malicious broker, potentially leading to remote code execution (RCE). The vulnerability affects deployments where dynamic.config.enabled is set or where an attacker has access to the Kafka cluster connected to Kafka UI.

In provectus kafka-ui up to version 0.7.2, the function validateAccess in /api/smartfilters/testexecutions is vulnerable to code injection. The attack can be initiated remotely, and the exploit is publicly available. The vendor did not respond.

Improper input validation in the component /kafka/ui/serdes/CustomSerdeLoader.java of kafka-ui v0.6.0 to v0.7.2 allows attackers to execute arbitrary code via supplying crafted data. The flaw results from insufficient validation of input before processing.