Splunk Connect for Kafka vulnerabilities

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user positioned in the network path could read or alter all relevant data sent from the connector when Kerberos authentication is used with HTTP Event Collector in Splunk Enterprise. The vulnerability exists because the Kerberos authentication path does not apply the configured certificate validation options when building the HTTP client.

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure a non-secure HTTP Event Collector endpoint in Splunk Enterprise, causing the connector to send authentication credentials to an attacker-controlled server. This could lead to credential exposure and compromise of data sent through the connector.

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit.

In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect REST API and influence responses from an HTTP Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit.