CyberRota Analysis
AI-GeneratedSplunk Connect for Kafka versions prior to 2.2.7 are vulnerable to an unauthenticated access issue that allows attackers to exploit the REST API for timestamp extraction by supplying crafted regular expressions. This can lead to the blocking of Kafka Connect worker threads, disrupting event delivery. Organizations using affected versions should prioritize patching to mitigate potential service interruptions.
Original NVD Description
In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API could configure timestamp extraction with a crafted regular expression and matching event data to block a Kafka Connect worker thread, stopping event delivery for the affected connector. The vulnerability is possible because timestamp extraction evaluates customer-supplied regular expressions without a time limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka) and Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka) in the Splunk documentation.
Related CVEs
Other vulnerabilities affecting the same vendor(s)