menu
techminis

A naukri.com initiative

New

google-web-stories
Home

>

Cyber Security News

>

New Kafka ...
source image

Dev

4d

read

252

img
dot

Image Credit: Dev

New Kafka Connect Vulnerability (CVE-2025-27817) Lets Attackers Read Any File

  • Apache Kafka Connect has a critical vulnerability (CVE-2025-27817) allowing unauthenticated attackers to remotely read arbitrary files.
  • The flaw stems from insecure handling of specific configuration parameters in Apache Kafka Connect.
  • Attackers can exploit this vulnerability by crafting malicious URLs to trigger arbitrary file reads or Server-Side Request Forgery (SSRF).
  • Potential impacts include unauthorized access to sensitive files, no authentication requirement, and the ability to work under default configurations.
  • Affected versions range from Apache Kafka 3.1.0 to 3.9.0.
  • Immediate actions include not exposing Kafka Connect to the internet, checking and restricting specific properties in standalone and distributed modes, and utilizing Web Application Firewalls or firewall rules.
  • Apache has released version 3.9.1 to address the vulnerability, and users are advised to upgrade promptly.
  • Various products offer support for detecting and protecting against this exploit, such as YunTu, DongJian, SafeLine, and QuanXi.
  • The timeline of events includes CVE disclosure on June 10, 2025, followed by references to the Apache Mailing List Disclosure and solutions provided by different entities.
  • Users are encouraged to join the SafeLine community for further information and updates.

Read Full Article

like

15 Likes

share

3 Shares

For uninterrupted reading, download the app