JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Combined with Jacksons default bean deserialization, a producer could supply crafted header values that caused the consumer to deserialize arbitrary JDK types.
Affected versions: Spring for Apache Kafka 4.0.0 through 4.0.5; 3.3.0 through 3.3.15; 3.2.0 through 3.2.13; 2.9.0 through 2.9.13; 2.8.0 through 2.8.11.
Weakness
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Spring_for_apache_kafka | Vmware | 2.8.0 (including) | 2.8.12 (excluding) |
| Spring_for_apache_kafka | Vmware | 2.9.0 (including) | 2.9.14 (excluding) |
| Spring_for_apache_kafka | Vmware | 3.2.0 (including) | 3.2.14 (excluding) |
| Spring_for_apache_kafka | Vmware | 3.3.0 (including) | 3.3.15.1 (excluding) |
| Spring_for_apache_kafka | Vmware | 4.0.0 (including) | 4.0.5.1 (excluding) |
Potential Mitigations
- Make fields transient to protect them from deserialization.
- An attempt to serialize and then deserialize a class containing transient fields will result in NULLs where the transient data should be. This is an excellent way to prevent time, environment-based, or sensitive variables from being carried over and used improperly.