CVE-2023-52251 PoC — kafka-ui 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-52251.yaml

Associated Vulnerability

Title:kafka-ui 操作系统命令注入漏洞 (CVE-2023-52251)
Description:kafka-ui是用于 Apache Kafka 的开源 Web UI。 kafka-ui 0.4.0版本至0.7.1版本存在安全漏洞，该漏洞源于允许远程攻击者通过/api/clusters/local/topics/messages的参数q执行任意代码。

Description

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.

File Snapshot


 id: CVE-2023-52251

info:
  name: Kafka UI 0.7.1 Command Injection
  author: yhy0,iamnoooob
  severi

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!