Description
EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
smartloli EFAK
Default version status: unaffected
5.0.0 to ≤ 5.1.0affected
pkg:github/smartloli/EFAKReferences
- https://hackmd.io/@hieuPenguinnn/efak-missing-admin-gate-user-management-api ↗
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/security/config/WebSecurityConfig.java#L89-L93 ↗
- https://github.com/smartloli/EFAK/blob/v5.1.0/efak-web/src/main/java/org/kafka/eagle/web/controller/UserController.java#L218-L302 ↗
- https://github.com/smartloli/EFAK ↗
- https://www.vulncheck.com/advisories/efak-through-5.1.0-privilege-escalation-via-api-users-rest-api ↗