Bypassing the JNDI Blocklist

▶ Watch (7:37)

Kafka 3.4.1 disabled the JNDI login module by default with a blocklist. The team found a proxy login module from JBoss that delegates authentication to another module. By configuring the proxy to delegate to JNDI, they bypassed the blocklist. The POC triggered JNDI injection and achieved remote code execution on Kafka clients.

LDAP Login Module and Confluent Callback Handler

▶ Watch (14:01)

The JDK’s LDAP login module calls a callback handler to get username and password. A non-blank password allows JNDI injection. Confluent’s filebased dynamic login callback handler reads from a local file like /etc/passwd. Setting the file to /etc/passwd and key to root provided a password. This triggered JNDI injection on Confluent 7.7.1.

First-Ever Kafka Broker RCE

▶ Watch (22:05)

Kafka broker had no prior RCE. The team found that listeners can be added dynamically. By sending a request to add a listener with SASL/SSL protocol and a custom JAAS configuration pointing to a JNDI server, the broker loaded the attacker’s JAAS config and triggered JNDI injection. This was the first RCE on Kafka broker.

Accidental Patch and Confluent Broker Bypass

▶ Watch (28:00)

The patch for the client vulnerability also fixed the broker because both use the same load function. The team bypassed this on Confluent’s broker by setting a callback handler class via listener configuration. They received the highest bug bounty from Confluent for this exploit.

Notable Quotes

we can use process locking module to bypass the back list Ji’an “azraelxuemo” Zhou · ▶ 9:09

So now I have discovered the first ever RC vulnerability in KKA broker Ji’an “azraelxuemo” Zhou · ▶ 27:41

the patch method related to the Kafka clan also affects Kafka server Ji’an “azraelxuemo” Zhou · ▶ 28:21

we were rewarded the highest ever bug bounting Confluent Ji’an “azraelxuemo” Zhou · ▶ 33:15

Key Takeaways

  • JBoss proxy login module bypasses Kafka’s JNDI blocklist.
  • LDAP login module plus Confluent callback handler reads /etc/passwd for RCE.
  • Dynamic listener reconfiguration enables first Kafka broker RCE.

About the Speaker(s)

Ji’an Zhou is a Security Engineer in Alibaba Cloud. He focuses on Java security and cloud native security. His work helped improve security at Google, Amazon, Cloudera, IBM, Microsoft, and Oracle. He has spoken at Black Hat, Zer0Con, and Off-by-One Con.

Ying Zhu is a Security Engineer in Alibaba Cloud. He is interested in Web application security, especially Java application security. He has reported many critical vulnerabilities to Amazon, Apache, Cloudera, Microsoft, and others.

Ziyang Li is a Security Engineer in Alibaba Cloud. He focuses on Java security and security products. He has reported many critical vulnerabilities to Amazon, Apache, Cloudera, Microsoft, and others.