Description
kafka-ui是用于 Apache Kafka 的开源 Web UI。Provectus Kafka-ui存在远程代码执行漏洞，该漏洞是由于messages接口对用户的请求验证不当导致的。
Provectus Kafka-ui CVE-2023-52251 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://github.com/BobTheShoplifter/CVE-2023-52251-POC
https://www.sentinelone.com/vulnerability-database/cve-2023-52251/
https://securitylab.github.com/advisories/GHSL-2023-229_GHSL-2023-230_kafka-ui/
https://pentest-tools.com/vulnerabilities-exploits/kafka-ui-071-command-injection_22916
https://avd.aliyun.com/detail?id=AVD-2023-52251
https://nvd.nist.gov/vuln/detail/CVE-2023-52251
https://github.blog/security/vulnerability-research/3-ways-to-get-remote-code-execution-in-kafka-ui/
https://exploitpoccom.wordpress.com/2024/06/24/cve-2023-52251-and-cve-2024-32030-exploit-pocs-apache-kafka-remote-code-execution-vulnerability-0-7-2/
https://attackerkb.com/topics/ATJ1hTVB8H/cve-2023-52251
https://www.rapid7.com/db/modules/exploit/linux/http/kafka_ui_unauth_rce_cve_2023_52251/
https://cn-sec.com/archives/2898045.html
https://rivers.chaitin.cn/blog/cqlplh10lnec5jjug6s0