CVE-2023-52251

HIGH EXPLOITED NUCLEI

Kafka UI Unauthenticated Remote Command Execution via the Groovy Filter option.

Title source: metasploit

Description

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.

Exploits (2)

nomisec WORKING POC 20 stars
by BobTheShoplifter · remote
https://github.com/BobTheShoplifter/CVE-2023-52251-POC
metasploit WORKING POC EXCELLENT
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/kafka_ui_unauth_rce_cve_2023_52251.rb

Nuclei Templates (1)

Kafka UI 0.7.1 Command Injection
HIGHVERIFIEDby yhy0,iamnoooob
FOFA: icon_hash="-1477045616"

References (2)

Scores

CVSS v3 8.8
EPSS 0.9357
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2025-12-02
CWE
CWE-94
Status published
Products (1)
provectus/ui 0.4.0 - 0.7.1
Published Jan 25, 2024
Tracked Since Feb 18, 2026