Impacted versions
- Confluent Platform <= 8.3.0, 8.2.2, 8.1.4, 8.0.6, 7.9.8, 7.8.9, 7.7.10, 7.6.12, 7.5.15
Recommended action
- Confluent Platform customers should upgrade to the latest patched release versions:7.5.16, 7.6.13, 7.7.11, 7.8.10, 7.9.9, 8.0.7, 8.1.5, 8.2.3, 8.3.1
Issue
A cluster link authenticating to a metadata server through a token login callback handler takes its target from metadataServerUrls in the handler's SASL JAAS configuration. That user-submitted URL was not validated, so a principal holding the cluster-administrator rights can create a source-initiated cluster link that could direct the broker to an arbitrary endpoint, and the broker would issue authenticated requests to it during link initialization.
This crosses a trust boundary in deployments where cluster administration is tenant-scoped while the broker itself runs in an operator-controlled network: the link creator gains server-side request forgery against internal services they cannot otherwise reach.
Remediation
- This issue is resolved in the following versions of Confluent Platform: 7.5.16, 7.6.13, 7.7.11, 7.8.10, 7.9.9, 8.0.7, 8.1.5, 8.2.3, 8.3.1.
- The patched releases validate the metadataServerUrls configured on a cluster link token login callback handler against the existing org.apache.kafka.sasl.oauthbearer.allowed.urls allowlist before the broker connects. Confluent recommends enabling this via the dynamic broker config confluent.cluster.link.token.handler.url.validation.enable (disabled by default) and configuring the permitted URLs. : https://docs.confluent.io/platform/7.5/multi-dc-deployments/cluster-linking/security.html#restrict-cluster-link-token-handler-urls. Please check the respective version of the documentation to match the Confluent Platform deployment.
CVSS Scores:
- CVSS: 5.9 (CVSS v3.1 Calculator)