CVE-2023-34040

CVE-2023-34040 Este PoC está clonado de https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 Acerca de nuestro proceso de análisis, visite el archivo PDF en el repositorio principal...

cve-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

kcatcher

Captura lo que acecha en tus clústeres de Kafka. Introducción Kcatcher es una utilidad de línea de comandos para enumerar y evaluar configuraciones de clústeres de Kafka. Se conecta a clústeres de Apache Kafka y recupera información detallada sobre brokers, temas, ACL e incluso mensajes de muestr...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

CVE-2023-52251-POC

CVE-2023-52251-POC Existe una vulnerabilidad de ejecución remota de código en provectus/kafka-ui. No hay parche al momento de escribir esto, pero el proveedor fue notificado por nosotros y por el equipo de VINCE sin recibir respuesta. El informe se envió el 27 de septiembre de 2023 a provectus...

CVE-2026-49098

CVE-2026-49098 — camel-kafka kafka.OVERRIDETOPIC Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime:...

CVE-2025-27817

Descargo de responsabilidad: Las vulnerabilidades descritas en este documento y los pasos para su reproducción se proporcionan únicamente con fines de investigación y educación en seguridad cibernética. Nadie debe utilizar la información proporcionada en este documento para fines ilegales o prueb...

kroxylicious-pqc-filter

Kroxylicious PQC Record Encryption Filter A Kroxylicious filter plugin that provides transparent Post-Quantum Cryptography PQC record-level encryption for Apache Kafka using ML-KEM FIPS 203 key encapsulation with AES-256-GCM symmetric encryption. Kafka producers and consumers require zero code...

fingerprintx

Features • Installation • Usage • Running fingerprintx • Using as a library • Why not nmap? • Notes • Acknowledgements fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port...

ROOT-APP-MAVEN-CVE-2026-41731 CVE-2026-41731 in org.springframework.kafka:spring-kafka - Patched by Root

Root has patched CVE-2026-41731 in the org.springframework.kafka:spring-kafka package for Root:Maven. Multiple fixed versions available...

Kafka UI 0.7.1 Command Injection

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/topic/messages. id: CVE-2023-52251 info: name: Kafka UI 0.7.1 Command Injection author: yhy0,iamnoooob severity: high description: | An...

kafka-keycloak-oauth

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Production-ready Apache Kafka 4.1.0 KRaft mode with Keycloak 26.1.1 OAuth2/OIDC authentication using Strimzi Kafka image. Why This Project vs kafka-oauth-keycloak-tls-demo This is an evolution of the previous POC with significant improvements...

Spring-Kafka-POC-CVE-2023-34040

Spring Kafka Deserialización POC Requisitos Java 11 Maven Docker o Kafka Uso Primero inicia la instancia Kafka dockerizada. Esto arrancará Kafka y lo dejará disponible en el puerto 29092. root@kitploit: docker-compose up Inicia la aplicación consumidora. root@kitploit: cd spring-kafka-consumer mv...

CVE-2023-34040

CVE-2023-34040 Spring Kafka Deserialization Remote Code Execution root@kitploit: POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

cve-2023-25194

Apache Druid CVE-2023-25194 CVE-2023-25194 es una vulnerabilidad de deserialización que afecta a Apache Kafka. Este go-exploit demuestra la explotación de CVE-2023-25194 contra Apache Druid usando Kafka. Este tipo de ataque normalmente requiere una infraestructura de atacante LDAP JNDI que...

GHSA-8WV5-X4W7-5GWW vulnerabilities

Vulnerabilities for packages: nri-cassandra, telegraf, nri-kafka, bento, seaweedfs, tempo, jitsucom-bulker, nri-jmx, wavefront-proxy, amazon-cloudwatch-agent, jaeger, datadog-agent, minio, temporal, grafana, zipkin...

CVE-2026-43871 vulnerabilities

Vulnerabilities for packages: nri-cassandra, telegraf, nri-kafka, bento, seaweedfs, tempo, jitsucom-bulker, nri-jmx, wavefront-proxy, amazon-cloudwatch-agent, jaeger, datadog-agent, minio, temporal, grafana, zipkin...

GHSA-6QM2-MCQ7-53QP vulnerabilities

Vulnerabilities for packages: nacos-docker, kayenta-fips, sonarqube, airflow, apicurio-registry, hadoop-client-modules, kafbat-ui-fips, py3-vllm-cuda-12.4, jenkins-plugin-manager, ruby4.0-jrjackson, apache-pulsar-fips, spdx-tools-java, hadoop-fips, druid, cassandra-fips, wso2is, elasticsearch-fip...

GHSA-6QM2-MCQ7-53QP vulnerabilities

Vulnerabilities for packages: ruby4.0-jrjackson, cassandra-reaper, apicurio-registry, kafka, scala, cass-config-builder, apache-tika, strimzi-kafka-operator, ruby3.4-jrjackson, confluent-kafka, trino, sonarqube, ruby3.3-jrjackson, gradle, druid, infinispan, solr, dependency-track, logstash,...