Description

A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the file kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java of the component Groovy Code Handler. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-24T02:17:04.120Z",
  "pubdate": "2026-08-24T02:17:04.120Z",
  "executiveSummary": "A remote code injection vulnerability has been identified in the provectus kafka-ui product affecting versions up to 0.7.2. The flaw resides within the Groovy Code Handler component, specifically inside the executeSmartFilterTest function located in kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java. The vulnerability allows remote attackers to execute arbitrary code by manipulating input passed to the vulnerable function. This security defect presents significant risk implications, as successful exploitation enables full remote code execution within the context of the application server. The attack can be launched remotely without requiring prior authentication, depending on network exposure configurations. Public exploits have been released, increasing the urgency for defensive measures. The vendor has been informed via an issue report but has not yet provided an official patch or response.",
  "technicalDetails": "The vulnerability is caused by improper neutralization of user-supplied input handled by the Groovy Code Handler component in provectus kafka-ui up to 0.7.2. Specifically, the execution flow within the executeSmartFilterTest function inside kafka-ui-api/src/main/java/com/provectus/kafka/ui/controller/MessagesController.java processes input intended for smart filtering tests without adequate sanitization or sandboxing, passing it directly into a Groovy evaluation or execution context. This design flaw leads directly to a code injection vulnerability.\nAttackers can exploit this flaw by crafting malicious payloads encapsulated within HTTP requests targeting the vulnerable endpoint exposed by MessagesController.java. The network exposure of the API allows remote adversaries to interact with the application over the network. Upon receiving the crafted payload, the executeSmartFilterTest function interprets and evaluates the injected script as native Groovy code. Because the application processes this input dynamically, the underlying Java Virtual Machine executes the attacker-supplied instructions with the privileges of the kafka-ui process.\nThe attack flow proceeds as follows: First, the adversary identifies the exposed endpoint corresponding to the executeSmartFilterTest function. Second, the attacker crafts a malicious HTTP request containing a Groovy code injection payload designed to execute arbitrary system commands or application-level logic. Third, the application receives the request and routes the payload to the vulnerable MessagesController.java component. Fourth, the component evaluates the payload through the Groovy execution engine without proper validation. Finally, the payload executes successfully, granting the attacker remote code execution capabilities and potential access to underlying infrastructure, sensitive configuration data, and connected Kafka clusters."
}