Improper Verification of Cryptographic Signature Affecting org.apache.kafka:kafka-clients package, versions [4.1.0,4.2.2)[4.3.0,4.3.1)

org.apache.kafka:kafka-clients is a streaming platform that can publish and subscribe to streams of records, store streams of records in a fault-tolerant durable way, and process streams of records as they occur.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the DefaultJwtValidator fallback in the configure method of the SASL/OAUTHBEARER OAuthBearerValidatorCallbackHandler. When a broker uses the default validator without a JWKS endpoint URL or verification-key resolver, it falls back to ClientJwtValidator, which does not verify JWT signatures, algorithms, or issuers. An unauthenticated remote attacker who can reach the listener can send a structurally valid forged JWT claiming any principal, including a configured superuser, and gain full access to the Kafka cluster.

Workarounds

• Set sasl.oauthbearer.jwks.endpoint.url for every listener and mechanism using OAuthBearerValidatorCallbackHandler to enable JWT signature verification and prevent acceptance of forged tokens.
• Configure sasl.oauthbearer.jwt.validator.class to use a signature-verifying validator, preventing the broker from accepting JWTs without signature verification.

• GitHub Commit
• GitHub Commit 4.2.2
• GitHub Commit 4.3.1
• GitHub Commit 4.4.0
• Red Hat Bugzilla Bug