Kafka-UI Denial-of-Service Vulnerability in Cluster Configuration Interface

A denial-of-service vulnerability has been identified in Kafka-UI versions 0.6.0 through 0.7.2. The issue arises in the 'Configure New Cluster' interface, where attackers can upload a crafted configuration file that disrupts the application's normal operation, causing it to crash.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to crash and become unresponsive.

Reproduction

To reproduce this vulnerability, navigate to the 'Configure New Cluster' interface on the Kafka-UI dashboard. Upload a malformed or invalid configuration file, such as a PDF, into the 'Schema Registry' input field. This action will trigger a crash, causing a denial-of-service condition.