Cmak
Monthly
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. Environments are at risk only if they run CMAK 3.0.0.6 or earlier and actively manage live Kafka clusters.
Cross-site request forgery in Yahoo CMAK (Cluster Manager for Apache Kafka) through 3.0.0.6 allows an attacker to make a logged-in operator's browser silently submit forged POST requests that delete topics or change cluster configuration, riding the operator's existing HTTP Basic credentials or play-basic-authentication cookie. The root cause is a confirmed missing CSRF filter combined with an authentication cookie that has no SameSite protection, so no per-request token stands between the forged request and destructive state-changing endpoints. The attacker needs no account of their own, but exploitation does require a valid authenticated operator session plus user interaction (luring that operator to attacker-controlled content), and no public exploit code has been identified at time of analysis.
Yahoo CMAK through 3.0.0.6 fails to enforce its scheduled leader election feature toggle on the PreferredReplicaElection HTML form routes, allowing an authenticated user (CVSS PR:L) with network access to the web UI to start or stop the recurring election scheduler and disrupt leadership across the Kafka clusters managed by that instance. This is a protection-mechanism failure (CWE-693) with no confidentiality impact (C:N) and limited integrity/availability impact (I:L/A:L); the assessed severity is low-to-moderate (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L), and no public exploit code has been identified at time of analysis. Environments are at risk only if they run CMAK 3.0.0.6 or earlier and actively manage live Kafka clusters.