Description
Apache Kafka是一款开源的分布式事件流平台，广泛用于高性能数据管道、流式分析和数据集成。该漏洞源于Apache Kafka Client在配置SASL/OAUTHBEARER连接时，对sasl.oauthbearer.token.endpoint.url和sasl.oauthbearer.jwks.endpoint.url参数的安全控制存在缺陷。攻击者可通过构造恶意URL参数，利用该缺陷实现任意文件读取或发起SSRF请求（访问非预期目标地址）。
Apache Kafka Connect /connectors 文件读取漏洞（CVE-2025-27817）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-27817
https://kafka.apache.org/community/cve-list/
https://support.confluent.io/hc/en-us/articles/39740309244180-CONFSA-2025-04-CVE-2025-27817-Confluent-Platform-and-Confluent-Cloud-Arbitrary-File-Read-and-Server-Side-Request-Forgery-SSRF-Vulnerability-via-unauthorized-changes-to-Kafka-Client-SASL-OAUTHBEARER-configuration
https://github.com/advisories/GHSA-vgq5-3255-v292
https://nsfocusglobal.com/apache-kafka-arbitrary-file-read-and-ssrf-vulnerability-cve-2025-27817/
https://www.herodevs.com/vulnerability-directory/cve-2025-27817
https://www.seal.security/blog/cve-2025-27817-why-the-kafka-oauth-vulnerability-isnt-really-fixed-in-3-9-1
https://security.snyk.io/vuln/SNYK-CHAINGUARDLATEST-STRIMZIKAFKAOPERATOR-10343265