Description
Apache Kafka Client是美国阿帕奇（Apache）基金会的一款Kafka客户端。 Apache Kafka Client存在安全漏洞，该漏洞源于配置数据验证不足，可能导致任意文件读取和服务端请求伪造。
Kafka Connect 任意文件读取漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://zhuanlan.zhihu.com/p/1942317485052375348
https://blog.csdn.net/WangsuSecurity/article/details/150617157
https://x.threatbook.com/v5/article?threatInfoID=161330
https://bbs.kanxue.com/thread-287293.htm
https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/Apache%20Kafka%20Clients%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E8%AF%BB%E5%8F%96%E4%B8%8ESSRF%20%E6%BC%8F%E6%B4%9E%20CVE-2025-27817.md
https://lmboke.com/archives/apache-kafka-connectjie-kou-cun-zai-ren-yi-wen-jian-du-qu-lou-dong-yu-ssrflou-dong-cve-2025-27817
https://it.shanghaitech.edu.cn/2025/0610/c8406a1111750/page.htm
https://www.cup.edu.cn/nic/wlaq/8c6d2894c11e4daf9350aeed6dc8321a.htm
https://m.freebuf.com/articles/vuls/435439.html
https://www.oscs1024.com/hd/MPS-pf90-i6zj
https://avd.aliyun.com/detail?id=AVD-2025-27817
https://nvd.nist.gov/vuln/detail/CVE-2025-27817
https://kafka.apache.org/community/cve-list/
https://www.sangfor.com/farsight-labs-threat-intelligence/cybersecurity/cve-2025-27817-apache-kafka-connect-arbitrary-file