Apache Kafka Client: Arbitrary file read and SSRF vulnerability

Vulnerability

Overview

CVE-2025-27817 is an arbitrary file read and Server-Side Request Forgery (SSRF) vulnerability in Apache Kafka Client. The flaw resides in the SASL/OAUTHBEARER authentication mechanism, which accepts configuration parameters sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url. These URLs are used to fetch tokens or JWKS data, but the client does not validate the scheme or destination, allowing an attacker to specify file:// URIs or internal network addresses [2][3].

Exploitation

Prerequisites

Exploitation requires that an untrusted party can supply Kafka client configuration values. This is particularly relevant in Apache Kafka Connect, where the REST API may allow setting connector configurations that include these parameters. No additional authentication is needed if the configuration endpoint is exposed. An attacker can set the token endpoint URL to a local file (e.g., file:///etc/passwd) or an internal service (e.g., http://internal-service/) [3].

Impact

Successful exploitation enables reading arbitrary files from the Kafka client's filesystem, including environment variables, and making HTTP requests to unintended internal or external hosts. The file content is returned in error logs, while SSRF can be used to probe internal networks or access cloud metadata endpoints. In SaaS environments, this could lead to significant information disclosure and lateral movement [2][3].

Mitigation

Apache Kafka 3.9.1 and 4.0.0 introduce a system property -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls to restrict permitted URLs. In 3.9.1, the default allows all URLs for backward compatibility; in 4.0.0 and later, the default is an empty list, requiring explicit configuration. Users should upgrade to a fixed version and set the allowed URLs to a safe list [2][3].