DEF CON 33 - Client or Server? Hidden Sword of Damocles in Kafka - Ji'an Zhou, Ying Zhu, ZiYang ' Li

Revised Summary (Optimized for Clarity, Accuracy, and Impact):

BLUF: A critical remote code execution (RCE) vulnerability was discovered in Apache Kafka, including in its broker and client components—marking the first-ever RCE vulnerability in the Kafka broker. The attack leveraged dynamic configuration bypasses, including LDAP/JMD injection and SASL/GSSAPI-triggered GS process exploitation, enabling full remote takeover. The vulnerability was patched in Kafka 3.4.0 (CVE-2023-25194), but the fix inadvertently impacted both client and broker sides due to shared code logic. A persistent RCE path remains in patched versions via a dynamic callback handler bypass. This discovery led to a record-breaking bug bounty from Confluent and earned recognition as a landmark achievement in Apache Kafka security.

Key Takeaways:

🔹 Remote Code Execution in Kafka Clients via JMD Injection & Poly Login Module Bypass

• Attackers exploit a controlled connection stream to trigger JMD (Java Naming and Directory Interface) injection in Kafka clients.
• The client uses a configurable login module, which can be manipulated to invoke a malicious JMD server.
• A backlist mechanism was introduced in version 3.4.1 to disable dangerous modules (e.g., JMD login), but this was bypassed using the Poly Login Module, which delegates authentication to another module (e.g., JMD) even if it’s on the backlist.
• This enables a full RCE chain through controlled login configuration and JMD injection.
  Source: 8:32–9:34

🔹 Exploitation of LDAP Login Module via Custom Callback Handler

• The built-in LDAP login module in JDK (used in Confluent Server) retrieves user credentials via a callback handler.
• A malicious callback handler—FileBasedDynamicCallbackHandler—was found in Confluent Server (v7.7.1), which reads usernames and passwords from local