Problem description

In the current Apache Kafka version (< 3.9.1), there is a potential security vulnerability related to the configuration of Kafka clients when using SASL/OAUTHBEARER:

The Kafka clients accept the configuration parameters:

• sasl.oauthbearer.token.endpoint.url

• sasl.oauthbearer.jwks.endpoint.url

These URLs are used to retrieve tokens or JWKs during authentication.

The transferred values could previously contain arbitrary URLs (e.g. file:///etc/passwd, http://localhost/internal-api), which could lead to arbitrary file read or SSRF (Server Side Request Forgery), especially if configurations come from insecure sources (e.g. SaaS integrations, external UIs or Kafka Connect REST APIs).

Solution

As of version 3.9.1, a new security measure has been introduced:

The new system property org.apache.kafka.sasl.oauthbearer.allowed.urls allows you to specify a whitelist of allowed URLs.

In 3.9.1, this whitelist is empty by default (= all URLs allowed) in order to remain downward compatible. As of version 4.0.0, all URLs are blocked unless explicitly allowed.

Aim of this ticket

• Upgrade the Kafka client version used from 3.9.0 to 3.9.1
• Introduction of the property: -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls
• This property must be configurable by the application, as customers or deployments use different OAuth endpoints.
• The property must accept multiple URLs (whitelist), in the form of a comma-separated list without spaces.

Example value: -Dorg.apache.kafka.sasl.oauthbearer.allowed.urls=https://auth.example.com/token,https://auth.example.com/jwks

The property sasl.oauthbearer.token.endpoint.url remains necessary for the functionality of Kafka authentication. It still specifies where the access token is retrieved. The only new feature is that this URL is now compared with the whitelist (allowed.urls).

The token.endpoint.url may therefore only use values contained in the whitelist, otherwise access is blocked.

Implementation

• Upgrade Kafka client to version 3.9.1
• Introduce new configuration option for org.apache.kafka.sasl.oauthbearer.allowed.urls
• Implement configuration as a list of permitted URLs (multiple values permitted)
• Validation: token.endpoint.url and jwks.endpoint.url must match this whitelist
• Protection at operating system level against unwanted file URLs