| शीर्षक | provectus kafka-ui 0.7.2 Improper Access Controls |
|---|
| विवरण | Groovy guard bypass RCE in executeSmartFilterTest (v0.7.2)
https://github.com/provectus/kafka-ui/
The vulnerability allows any authenticated user to execute arbitrary operating system commands on the
server, bypassing the filtering.groovy.enabled security control that was introduced to prevent
Groovy-based code execution.
Summary
The PUT /api/smartfilters/testexecutions endpoint executes arbitrary Groovy scripts without
checking the filtering.groovy.enabled property. When an administrator sets
filtering.groovy.enabled=false (the default) to disable Groovy script execution, the restriction
only applies to the message filtering endpoint (GET /api/clusters/.../messages). The
testexecutions endpoint is not guarded by this check and will execute any Groovy script regardless
of the setting. This allows any authenticated user to achieve remote code execution on the server.
Technical Details
The vulnerability is in MessagesController.java. The executeSmartFilterTest method (line 75) does
not call checkIfFilteringGroovyEnabled(), while getTopicMessages does. The method passes the
attacker-supplied filterCode directly to MessageFilters.createMsgFilter() with type GROOVY_SCRIPT,
which compiles and evaluates it using GroovyScriptEngineImpl.
Relevant source locations:
kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java, line 75
kafka-ui-api/src/main/java/com/provectus/kafka/ui/service/MessagesService.java, line 86
kafka-ui-api/src/main/java/com/provectus/kafka/ui/emitter/MessageFilters.java, line 41
|
|---|
| स्रोत | ⚠️ https://github.com/provectus/kafka-ui/issues/4567 |
|---|
| उपयोगकर्ता | geochen (UID 78995) |
|---|
| सबमिशन | 09/07/2026 02:58 AM (2 महीनों पहले) |
|---|
| संयम | 23/08/2026 03:57 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394555 [provectus kafka-ui तक 0.7.2 Groovy Code MessagesController.java executeSmartFilterTest अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|