Kafka-UI Remote Code Execution Vulnerability via Custom Serde Loading

A remote code execution vulnerability has been identified in Kafka-UI versions 0.6.0 through 0.7.2. The issue arises from improper input validation in the Custom Serde Loader component, allowing attackers to execute arbitrary code by supplying crafted data. Exploitation involves uploading a malicious JAR file to an accessible path, which the application may then load and execute.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Kafka-UI is running, with the same privileges as the Kafka-UI process.

Reproduction

To reproduce this vulnerability, navigate to the 'Configure new cluster' interface in Kafka-UI. In the Serde configuration section, submit a PUT request to the '/api/config' endpoint with a payload that includes a 'serde' element pointing to a malicious JAR file. The application will attempt to load and execute the code from the JAR, leading to remote code execution.