[Kafka Connect] [JdbcSinkConnector][HttpSinkConnector] RCE by leveraging file upload via SQLite JDBC driver and SSRF to internal Jolokia

How it was found

Summary:

The Aiven JDBC sink includes the SQLite JDBC Driver. This JDBC driver can be used to upload SQLite database files onto the server. The HTTP sink connector allows sending HTTP requests to localhost. There is unprotected Jolokia listening on localhost:6725. JMX exports the com.sun.management:type=DiagnosticCommand MBean, which contains the jvmtiAgentLoad operation. This operation can be used to execute the SQLite database as JVM Agent by embedding the JVM Agent JAR file inside the SQLite database as an BLOB field in a table.

Steps To Reproduce:

{F1703051}

1. Login into my VPS: ssh ████, password: █████████@
2. Execute nc -nlvp 4446
3. cd to jdbc-sqlite-jolokia-rce and run python3 poc.py (if running locally, install kafka-python using pip first).
4. Reverse shell connection should now be established to my test instance

Impact

RCE on the Kafka Connect server