CVE-2025-27818

GitHubCurated repository PoCScannerCexploitintel/eip-pocs-and-cves

PoC files

28 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact contains Python scripts that test for CVE-2025-27818 by sending connector configurations to the Kafka Connect REST API and observing whether the LdapLoginModule is accepted or blocked. The primary script (poc.py) performs a differential test, creating connectors with JndiLoginModule and LdapLoginModule to check the denylist status. The scripts do not deliver a payload or achieve code execution; they only detect and report the vulnerability's presence.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates a legitimate CVE-2025-27818 vulnerability exploit against Apache Kafka Connect. All scripts and modules perform only the documented attack chain: creating connectors with specific JAAS configurations to test denylist bypass and trigger outbound LDAP connections. No concealed backdoor, credential theft, persistence, or unrelated payload delivery was observed in the reviewed text evidence.

ClassificationScanner
Model confidence95%
AuthenticationNot required
Languagespythonjava
Target softwareApache Kafka Connect
Attack typesdeserialization of untrusted dataserver-side request forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact (poc.py) creates connectors to test whether LdapLoginModule is blocked by the JAAS denylist. It does not deliver a malicious LDAP response, execute a deserialization gadget chain, or achieve code execution. Its stated purpose is a 'Differential Test' to confirm the denylist bypass, which is detection/validation behavior consistent with a scanner.

poc/poc.py:19-28poc/poc.py:283-295

Requirements

  • Access to the Kafka Connect REST API (default: no authentication, port 8083).README.md:23-24
  • A running Kafka Connect worker with the vulnerable version (2.3.0–3.9.0).README.md:14

Observed behavior

  • Sends HTTP POST requests to the Kafka Connect REST API to create connectors with specific SASL JAAS configurations containing JndiLoginModule or LdapLoginModule.poc/poc.py:102-122
  • Checks the connector task status to determine if the LoginModule was blocked (denylist hit) or accepted (bypass confirmed).poc/poc.py:135-163
  • Reports whether the target is vulnerable based on the differential result of the two LoginModule tests.poc/poc.py:296-316
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Outbound Connection Target
ldap://127.0.0.1:1389Hardcoded attacker LDAP server address used in PoC scripts to demonstrate the SSRF/deserialization path of the CVE.poc/poc.py:55poc/poc_vector2.py:65
Custom Login Module
OutboundLdapModuleCustom Java LoginModule that makes an outbound LDAP connection to an attacker-controlled server, used to prove the full exploitation path.poc/OutboundLdapModule.java:30-70
Network Service
Kafka Connect REST API on port 8083Target service for the exploit, used to create malicious connector configurations.CVE-LAB.md:23-24
Review boundaries

What the analysis did not establish

  • Four binary files (Java bytecode and JARs) are present but were not analyzed; their content could not be inspected.
  • The analysis is based solely on the supplied text evidence; the code was not executed, and its behavior was not verified in a live environment.
  • Four binary files (two JARs, two Java class files) were not analyzed; their source code is provided and appears consistent, but the compiled artifacts could theoretically differ.
  • The review is limited to the supplied text evidence and does not include dynamic analysis of the PoC execution.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

2
GitHub

CVE-2025-27818/docker-compose.yml

Created Vuln labCVE-2025-27818Compose · builds

1 Compose manifest · 1 Dockerfile · 2 services

Lab screenshot for CVE-2025-27818/docker-compose.yml
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose lab for CVE-2025-27818, an Apache Kafka Connect LdapLoginModule denylist bypass vulnerability. It defines two services (broker and vulnerable) built from a single Dockerfile that installs Kafka 3.9.0, and includes PoC scripts to demonstrate the bypass.

CVE-2025-27818/docker-compose.yml:1-56CVE-2025-27818/Dockerfile.vulnerable:1-48CVE-2025-27818/README.md:1-215

Lab assessment

Vulnerability lab

The README explicitly describes the environment as a 'CVE-2025-27818 Lab' for demonstrating a denylist bypass in Apache Kafka Connect. The Docker Compose file and Dockerfile build a vulnerable Kafka 3.9.0 instance, and multiple PoC scripts are provided to exercise the vulnerability.

CVE-2025-27818/README.md:1-3CVE-2025-27818/docker-compose.yml:1-3CVE-2025-27818/Dockerfile.vulnerable:1-3
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

broker

Kafka broker (KRaft mode)

A Kafka 3.9.0 broker running in KRaft mode, providing the messaging backbone for the lab. It formats storage and starts the broker using entrypoint-broker.sh.

CVE-2025-27818/docker-compose.yml:8-24CVE-2025-27818/entrypoint-broker.sh:1-14

vulnerable

Kafka Connect distributed worker (vulnerable target)

A Kafka Connect 3.9.0 distributed worker exposing the REST API on port 8083. It is configured with connector.client.config.override.policy=All, allowing SASL JAAS config overrides that are exploited by the PoC.

CVE-2025-27818/docker-compose.yml:26-50CVE-2025-27818/connect-distributed.properties:31-33

poc.py

Primary PoC script (denylist bypass differential test)

A Python script that creates two connectors via the REST API—one with JndiLoginModule (expected blocked) and one with LdapLoginModule (expected accepted)—to demonstrate the incomplete denylist.

CVE-2025-27818/poc/poc.py:1-329

poc_vector2.py

PoC script (outbound LDAP connection)

A Python script that starts an LDAP listener and creates a connector using a custom OutboundLdapModule to trigger an outbound LDAP connection from the Connect worker, demonstrating the SSRF-to-deserialization path.

CVE-2025-27818/poc/poc_vector2.py:1-287

poc_vector3.py

PoC script (multiple override prefix paths)

A Python script that tests all three SASL JAAS override prefixes (producer.override, consumer.override, admin.override) to confirm each accepts LdapLoginModule.

CVE-2025-27818/poc/poc_vector3.py:1-270

outbound-ldap-module.jar

Custom LoginModule (binary, uninspected)

A pre-compiled JAR copied into the Docker image at /opt/kafka/libs/outbound-ldap-module.jar. Used by poc_vector2.py to make outbound LDAP connections. BINARY—behavior not inspected.

CVE-2025-27818/Dockerfile.vulnerable:33

shared-state-module.jar

Helper LoginModule (binary, uninspected)

A pre-compiled JAR copied into the Docker image at /opt/kafka/libs/shared-state-module.jar. Described as a helper module not used in the final PoC. BINARY—behavior not inspected.

CVE-2025-27818/Dockerfile.vulnerable:34
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-27818

Supported by supplied evidence

The entire lab is built around CVE-2025-27818. The README, PoC scripts, and verification report all describe the LdapLoginModule denylist bypass in Kafka Connect 3.9.0, and the Docker Compose file deploys the vulnerable version.

CVE-2025-27818/README.md:1-3CVE-2025-27818/poc/poc.py:1-5CVE-2025-27818/poc_verification_report.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.CVE-2025-27818/README.md:88-90
  • Python 3 with no external dependencies (stdlib only) to run the PoC scripts.CVE-2025-27818/README.md:107
  • The lab containers must be built and started (docker compose up -d) and the Connect REST API must be healthy on port 8083.CVE-2025-27818/README.md:88-95

Evidence-described exercise path

  1. Build and start the lab: docker compose build && docker compose up -dCVE-2025-27818/README.md:88-90
  2. Wait for broker and connect services to become healthy (~30-60s).CVE-2025-27818/README.md:92-93
  3. Run the primary PoC: python3 poc/poc.py 127.0.0.1 8083CVE-2025-27818/README.md:95
  4. Optionally run Vector 2 (outbound LDAP) and Vector 3 (multiple override prefixes) PoCs.CVE-2025-27818/README.md:113-123
  5. Clean up: docker compose downCVE-2025-27818/README.md:97
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own target (the Kafka Connect worker). The PoC scripts interact only with the lab's REST API on localhost:8083 and start a local LDAP listener. The Docker Compose file uses a standard bridge network, no privileged mode, no host filesystem mounts, and no credential theft or persistence mechanisms. The outbound LDAP connection in Vector 2 is an expected demonstration of the vulnerability and targets a listener started by the PoC itself.

CVE-2025-27818/docker-compose.yml:1-56CVE-2025-27818/poc/poc_vector2.py:1-287
Review boundaries

What the analysis did not establish

  • Two JAR files (outbound-ldap-module.jar and shared-state-module.jar) are binary and uninspected; their exact behavior cannot be confirmed from the supplied text.
  • The packet does not include the full repository context; only the CVE-2025-27818 directory is provided.
  • The analysis cannot verify whether the PoC scripts would behave differently if run against a non-lab target, but within the supplied evidence they only target the lab's own services.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Packet coverage: 2 binary files not inspected

GitHub

CVE-2025-27818/docker-compose.patched.yml

Created Vuln labCVE-2025-27818Compose · builds

1 Compose manifest · 1 Dockerfile · 2 services

Lab screenshot for CVE-2025-27818/docker-compose.patched.yml
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment for testing CVE-2025-27818, a denylist bypass in Apache Kafka Connect. It deploys a patched Kafka 3.9.1 broker and a patched Kafka Connect worker, intended to verify that the LdapLoginModule fix is effective or to test bypass techniques against the patched version.

CVE-2025-27818/docker-compose.patched.yml:1-4CVE-2025-27818/Dockerfile.patched:1-5

Lab assessment

Vulnerability lab

The environment is explicitly labeled as a lab for CVE-2025-27818, includes a patched Kafka version, and provides PoC scripts to test the vulnerability. The README and verification report describe the vulnerability, attack chain, and lab usage.

CVE-2025-27818/README.md:1-3CVE-2025-27818/docker-compose.patched.yml:1-4
Lab shapeCompose · builds
Services2
Compose manifests1
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

broker-patched

Kafka broker (KRaft mode)

A single-node Kafka broker and controller running Kafka 3.9.1 in KRaft mode. It formats storage and starts the broker, providing the messaging backbone for the Connect worker.

CVE-2025-27818/docker-compose.patched.yml:10-28CVE-2025-27818/entrypoint-broker-patched.sh:1-14

connect-patched

Kafka Connect worker (REST API)

A distributed Kafka Connect worker running Kafka 3.9.1. It exposes the REST API on port 8083, waits for the broker to be healthy, and starts with a configuration that allows all connector config overrides (the attack vector).

CVE-2025-27818/docker-compose.patched.yml:30-55CVE-2025-27818/entrypoint-connect-patched.sh:1-15CVE-2025-27818/connect-distributed-patched.properties:33-34

PoC scripts

Exploit verification tools

Three Python scripts (poc.py, poc_vector2.py, poc_vector3.py) that test the denylist bypass by creating connectors with LdapLoginModule via the Connect REST API. They are standalone and use only the Python standard library.

CVE-2025-27818/README.md:120-145CVE-2025-27818/poc/poc.py:1-30
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-27818

Supported by supplied evidence

The entire lab is built around CVE-2025-27818. The README, verification report, and PoC scripts explicitly describe the vulnerability, the incomplete denylist, and the attack chain. The patched Dockerfile and Compose file are designed to test the fix.

CVE-2025-27818/README.md:1-3CVE-2025-27818/poc_verification_report.md:1-10
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose installed on the host.CVE-2025-27818/README.md:107-110
  • Python 3 available on the host to run the PoC scripts.CVE-2025-27818/README.md:120-122
  • The Connect REST API must be reachable (port 8083 mapped to host).CVE-2025-27818/docker-compose.patched.yml:38-39

Evidence-described exercise path

  1. Build the Docker images using 'docker compose -f docker-compose.patched.yml build'.CVE-2025-27818/docker-compose.patched.yml:5-6
  2. Start the lab with 'docker compose -f docker-compose.patched.yml up -d'.CVE-2025-27818/docker-compose.patched.yml:7
  3. Run the primary PoC script: 'python3 poc/bypass_poc.py 127.0.0.1 8083' (or the actual poc.py).CVE-2025-27818/docker-compose.patched.yml:8CVE-2025-27818/README.md:120-122
  4. Optionally run vector2 and vector3 PoCs to test outbound LDAP connections and multiple override prefixes.CVE-2025-27818/README.md:130-145
  5. Tear down the lab with 'docker compose -f docker-compose.patched.yml down'.CVE-2025-27818/docker-compose.patched.yml:9
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the contained lab target. The PoC scripts interact only with the Connect REST API inside the Docker network. The Compose file maps port 8083 to the host, which is a standard lab requirement for accessing the API. No host escape, persistence, credential theft, or external connections beyond the documented lab are observed.

CVE-2025-27818/docker-compose.patched.yml:38-39CVE-2025-27818/poc/poc.py:1-30
Review boundaries

What the analysis did not establish

  • The packet includes only the patched Compose file and Dockerfile; the vulnerable versions (docker-compose.yml, Dockerfile.vulnerable) are present in the file inventory but not included in evidence_files, so the vulnerable lab cannot be fully assessed.
  • Binary JAR files (outbound-ldap-module.jar, shared-state-module.jar) and compiled .class files are present in the inventory but not inspected; their behavior is unknown.
  • The PoC scripts reference a custom OutboundLdapModule that is pre-deployed in the Docker image, but the Dockerfile.patched does not show it being copied; the vulnerable Dockerfile may include it, but that file is not in the evidence set.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

3