How to Get Remote Code Execution in Kafka UI | Hacker News Reader

How to Get Remote Code Execution in Kafka UI

github.blog

52 pointsjandeboevrie6 comments

To avoid confusion: all the described issues aren’t with Apache Kafka, but a separate piece of software called “Kafka UI” that is a separate software to Apache Kafka, and isn’t maintained or distributed with it.

This is where Apache has gotten a bit touchy about project naming using its trademarks in the past, AKHQ used to be KafkaHQ, for example.

Apache projects carry with them reputation of the ASF itself, not just in regard to software quality, but also in regard to governance. The desire to not have projects that aren’t beholden to those standards being mistaken as one who do makes perfect sense, as is the case here: the headline made me thought Apache Kafka and its PMC were at fault.

I agree the reasoning is fair.

> Similar to the previous issue, it took almost six months for developers to implement a fix in version 0.7.2 of Kafka UI. They fixed it by only updating the Apache Commons Collections library to the newer version. While it prevents the second stage of the gadget chain I shared above, the deserialization of untrusted data still can occur.

This is concerning, that it took that long for it to be addressed.. also, the changelog involving these issues doesn't exactly inspire confidence because it has fixing the issues marked as a 'chore'[0] - this could cause people to skip the update if they skim it and see the only change was a 'chore' change.

[0]: https://github.com/provectus/kafka-ui/releases/tag/v0.7.2

Edit: After taking a closer look, the long timeline for the fix makes a little bit more sense - Provectus, the company behind kafka-ui, made a point late last year that they are pausing or otherwise stepping back from active development of the project[1]. I still think that 6 months is a bit of a long time, but with the additional context it seems less like security neglience and more just the project not being anyones' focus.

[1]: https://github.com/provectus/kafka-ui/discussions/4255

Not sure if people are still using Kafka UI. It's essentially unmaintained for a while now.

While the release notes of Kafka UI 0.7.2 [1] only mention the security fixes, it contains 1 year (!) worth of changes [2].

The designated successor is Kafbat UI [3,4], developed by the same development team which previously worked on Kafka UI.

Kafbat UI 1.0.0 [5] already contains a fix for CVE-2023-52251 [6].

[1]: https://github.com/provectus/kafka-ui/releases/tag/v0.7.2

[2]: https://github.com/provectus/kafka-ui/compare/v0.7.1...v0.7....

[3]: https://github.com/kafbat/kafka-ui

[4]: https://github.com/kafbat/kafka-ui/discussions/23

[5]: https://github.com/kafbat/kafka-ui/releases/tag/v1.0.0

[6]: https://nvd.nist.gov/vuln/detail/CVE-2023-52251

Reply on news.ycombinator.com