Khai Tran

An authenticated principal with no authorization grants can force a broker to read and return the contents of a file or an environment variable from the broker host. This occurs because `IncrementalAlterConfigs` or `AlterConfigs` requests targeting a BROKER resource undergo configuration validation before authorization checks are applied. During this process, the system resolves configuration variables using a `ConfigProvider` specified in the request, bypassing the established allowlist. This allows the instantiation of arbitrary providers, such as `FileConfigProvider` or `EnvVarConfigProvider`, which can then expose sensitive data like credentials or keystores through type-validation errors. The impact is limited to files and environment variables accessible to the broker process's operating-system permissions.

Processing maliciously crafted web content may lead to an unexpected process crash due to improper memory handling.

A malicious website may exfiltrate data cross-origin. This occurs due to insufficient checks within the software.

An out-of-bounds write issue exists where processing maliciously crafted web content may lead to an unexpected Safari crash. This occurs due to insufficient input validation, where an out-of-bounds write is a condition where a program writes data past the end of the intended buffer, potentially corrupting memory.

The issue affects confidentiality and can be exploited by remote authenticated users via unknown vectors. It is claimed to be an XML external entity (XXE) vulnerability in the XML parser, which could allow attackers to conduct internal port scanning, perform Server-Side Request Forgery (SSRF) attacks, or cause a denial of service via a crafted URI, such as `http:` or `ftp:`.