Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-34040
CVE-2023-34040:
Java vulnerability analysis and mitigation
Overview
In Spring for Apache Kafka 3.0.9 and earlier and versions 2.9.10 and earlier, a possible deserialization attack vector existed when improperly configured. The vulnerability, identified as CVE-2023-34040, was discovered and reported by Joseph Beeton from Contrast Security, Inc. The issue affects Spring for Apache Kafka versions from 2.8.1 to 2.9.10 and 3.0.0 to 3.0.9 (Spring Advisory).
Technical details
The vulnerability allows an attacker to construct a malicious serialized object in one of the deserialization exception record headers. The application becomes vulnerable when three specific conditions are met: the user does not configure an ErrorHandlingDeserializer for the key and/or value of the record, the user explicitly sets container properties checkDeserExWhenKeyNull and/or checkDeserExWhenValueNull to true, and the user allows untrusted sources to publish to a Kafka topic. By default, these properties are false, and the container only attempts to deserialize the headers if an ErrorHandlingDeserializer is configured. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) (NVD).
Impact
If successfully exploited, this vulnerability could lead to deserialization of untrusted data, potentially resulting in remote code execution in the affected systems. The ErrorHandlingDeserializer, when properly configured, prevents the vulnerability by removing any malicious headers before processing the record (Spring Advisory).
Mitigation and workarounds
Organizations are advised to implement one of the following mitigations: do not set container properties checkDeserExWhenKeyNull or checkDeserExWhenValueNull when not using ErrorHandlingDeserializers, or use ErrorHandlingDeserializers. For version-specific fixes, 2.8.x and 2.9.x users should upgrade to 2.9.11, while 3.0.x users should upgrade to 3.0.10. Spring Boot 3.0.10 (or later) dependency management will automatically use Spring for Apache Kafka 3.0.10 (or later). Spring Boot 2.7.x users should override Boot's Spring for Apache Kafka 2.8.x dependency management version to 2.9.11 (or later) (Spring Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management