CVE-2023-34040: Spring-Kafka Java Deserialization Vulnerability
Summary
CVE-2023-34040: Spring-Kafka has Java Deserialization vulnerability When Improperly Configured. Affects org.springframework.kafka:spring-kafka across 2 version ranges.
>= 2.8.1, < 2.9.11
>= 3.0.0, < 3.0.10
Fixed in 2.9.11 or 3.0.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring-Kafka is a library that provides support for Kafka-based messaging in Spring applications. It allows developers to easily integrate Kafka messaging into their Spring projects. The library is widely used in Java applications that rely on Kafka for asynchronous communication and event-driven architectures. However, versions 2.9.10 and earlier, as well as 3.0.9 and earlier, are vulnerable to a Java deserialization vulnerability when improperly configured.
Vulnerability Detail
The vulnerability in Spring-Kafka arises when an application is configured in a specific way and allows untrusted sources to publish to a Kafka topic. In this scenario, an attacker can construct a malicious serialized object in the deserialization exception record headers. To exploit the vulnerability, the following conditions must be met: 1) The user does not configure an ErrorHandlingDeserializer for the key and/or value of the record. 2) The user explicitly sets the container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull to true. By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The vulnerability can lead to remote code execution and other potential security risks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.1, < 2.9.112.9.11 -
>= 3.0.0, < 3.0.103.0.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the fixed versions is not immediately possible, a workaround is to configure an ErrorHandlingDeserializer for the key and/or value of the record. This can be done by implementing a custom deserializer that handles deserialization exceptions appropriately and configuring it in the application. By using an ErrorHandlingDeserializer, the vulnerability can be mitigated even if the checkDeserExWhenKeyNull and checkDeserExWhenValueNull properties are set to true.
Conclusion
The Java deserialization vulnerability in Spring-Kafka can be mitigated by upgrading to the fixed versions or implementing a workaround. It is crucial to take immediate action to protect your application from potential remote code execution and other security risks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.kafka:spring-kafka →
FAQ
Spring-Kafka is a library that provides support for Kafka-based messaging in Spring applications. It allows developers to easily integrate Kafka messaging into their Spring projects.
Versions 2.9.10 and earlier, as well as 3.0.9 and earlier, are affected by this vulnerability.
The vulnerability can lead to remote code execution and other potential security risks.
To fix the vulnerability, it is recommended to upgrade to the fixed versions of Spring-Kafka (2.9.11 or later for 2.x versions, and 3.0.10 or later for 3.x versions).
Yes, a workaround is to configure an ErrorHandlingDeserializer for the key and/or value of the record.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.kafka:spring-kafka.
