Client or Server? Hidden Sword of Damocles in Kafka
Reveals critical architectural and deserialization vulnerabilities across Apache Kafka client and server implementations, enabling remote code execution.
Summary
Apache Kafka in Modern Enterprise Architectures
Apache Kafka functions as the distributed event streaming backbone for thousands of enterprises, processing trillions of mission-critical messages across cloud pipelines daily.
Analyzing Kafka Client-Server Protocols
Ji'an Zhou, Ying Zhu, and ZiYang Li audit Kafka's network protocol implementations, SASL authentication handshakes, and third-party connector plugins, discovering critical security flaws.
Exploiting JNDI Injection and Deserialization in Connectors
Researchers demonstrate how untrusted data streams and malicious connector configurations trigger remote code execution via unsafe Java deserialization and JNDI injection on Kafka brokers and clients.
Hardening Kafka Streaming Deployments
Mitigating streaming vulnerabilities requires disabling dynamic plugin loading, enforcing strict SASL/SCRAM authentication, and deploying network segmentation around event streaming clusters.
Related talks
Main Stage·50 min
Lior Shmueli · Tomer Peled
Exposes UI redressing and clickjacking vectors in popular browser extensions that trick users into granting administrative cloud permissions with a single click.
Main Stage·35 min
Ji'an Zhou · Lishuo Song
Discloses multiple memory corruption and deserialization vulnerabilities in PyTorch's TorchScript JIT engine that allow arbitrary remote code execution via malicious AI models.
Main Stage·39 min
Anna Antonenko
Demonstrates remote code execution across audio software and operating system synthesis engines by weaponizing malformed MIDI protocol messages.