CVE-2024-27309
📋 TL;DR
During Apache Kafka migration from ZooKeeper to KRaft mode, ACL enforcement can fail when removing an ACL from a resource with multiple ACLs, causing Kafka to incorrectly treat the resource as having only one ACL. This affects administrators performing ZooKeeper-to-KRaft migrations. The impact ranges from availability issues (if only ALLOW ACLs exist) to potential confidentiality/integrity breaches (if DENY ACLs exist).
💻 Affected Systems
- Apache Kafka
📦 What is this software?
Kafka by Apache
⚠️ Risk & Real-World Impact
Worst Case
DENY ACLs are ignored during migration, allowing unauthorized access to Kafka resources, potentially leading to data exposure, modification, or deletion.
Likely Case
Availability impact where ALLOW ACLs aren't properly enforced, causing legitimate users to be denied access to Kafka resources during migration.
If Mitigated
Limited availability impact if only ALLOW ACLs are configured and migration is carefully monitored.
🎯 Exploit Status
Exploitation requires administrative access to modify ACLs during migration and specific conditions (removing ACL from resource with multiple ACLs).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Apache Kafka security advisories for specific patched versions
Vendor Advisory: https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy
Restart Required: Yes
Instructions:
1. Check Apache Kafka security advisory for patched version. 2. Update Kafka to patched version. 3. Restart Kafka brokers. 4. Verify migration completion and ACL enforcement.
🔧 Temporary Workarounds
Avoid ACL modifications during migration
allDo not remove ACLs from resources that have multiple ACLs during ZooKeeper-to-KRaft migration
Complete migration before ACL changes
allFinish ZooKeeper-to-KRaft migration completely before making any ACL modifications
🧯 If You Can't Patch
- Postpone ZooKeeper-to-KRaft migration until patch can be applied
- Monitor ACL changes and Kafka access logs closely during migration for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check if Kafka cluster is actively migrating from ZooKeeper to KRaft mode and ACLs have been recently modifiedCheck Version:
kafka-broker-api-versions --bootstrap-server localhost:9092 | grep versionVerify Fix Applied:
Verify Kafka version is patched, complete migration, and test ACL enforcement on resources with multiple ACLs📡 Detection & Monitoring
Log Indicators:
- Unexpected access to Kafka resources during migration
- ACL modification logs during migration period
- Authorization failure/success anomalies
Network Indicators:
- Unauthorized Kafka protocol requests during migration window
SIEM Query:
source="kafka*" AND ("ACL" OR "authorization") AND "migration" AND ("remove" OR "delete")🔗 References
- http://www.openwall.com/lists/oss-security/2024/04/12/3
- https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy
- https://security.netapp.com/advisory/ntap-20240705-0002/
- http://www.openwall.com/lists/oss-security/2024/04/12/3
- https://lists.apache.org/thread/6536rmzyg076lzzdw2xdktvnz163mjpy
- https://security.netapp.com/advisory/ntap-20240705-0002/
