Data quality issue with CVE-2023-52251 (empty package/summary; affected range also incomplete)

[Galleleo]

The CVE ID

CVE-2023-52251 — https://osv.dev/vulnerability/CVE-2023-52251
(API: https://api.osv.dev/v1/vulns/CVE-2023-52251)

This is a CVE record, not a GHSA record.

Describe the data quality issue observed

The record resolves, but it carries no usable data:

• summary is empty
• the affected block has no package, so no consumer can match it

The upstream cause is the MITRE CVE record, which was published with vendor: n/a,
product: n/a and version: n/a. I have filed a CVE update request with MITRE to populate
those fields. This report is to flag the OSV side and to put the correct data on record in
the meantime.

There is a second, independent problem: the affected version range published by NVD is
incomplete. NVD's description says "provectus kafka-ui 0.4.0 through 0.7.1". Version
0.7.2 is affected as well.

Evidence for that, measured 2026-09-08:

• The vulnerable code is in
  kafka-ui-api/src/main/java/com/provectus/kafka/ui/emitter/MessageFilters.java. In both
  v0.7.1 and v0.7.2 that file is 98 lines and identical, importing
  org.codehaus.groovy.jsr223.GroovyScriptEngineImpl and dispatching
  case GROOVY_SCRIPT: return groovyScriptFilter(query);. No mitigation was added between
  the two tags.
• v0.7.2 was released 2024-04-10, two and a half months after this CVE was published.
• The Docker tags provectuslabs/kafka-ui:latest and provectuslabs/kafka-ui:v0.7.2
  resolve to the same image digest,
  sha256:8f2ff02d64b0a7a2b71b6b3b3148b85f66d00ec20ad40c30bdcd415d46d31818.

So the default tag people pull today is vulnerable, while the published range tells them
0.7.2 is out of scope.

Suggested changes to record

• summary: Remote code execution in provectus/kafka-ui via Groovy evaluation in the
  message "smart filter", reachable through the q parameter of
  /api/clusters/local/topics/{topic}/messages.
• Affected product: provectus/kafka-ui, distributed as the Docker image
  provectuslabs/kafka-ui.
• Affected versions: >= 0.4.0, <= 0.7.2.
• Fixed version: none for this product. The fix exists only in the community fork
  kafbat/kafka-ui, which replaced Groovy with CEL in commit
  kafbat/kafka-ui@11a57d14 (2024-02-10), first released in
  v1.0.0 (2024-03-21). That fork changed its Java package namespace from
  com.provectus.kafka.ui to io.kafbat.ui, so remediation is a migration to a different
  artifact, not a version upgrade.

I appreciate that OSV has no Docker/OCI ecosystem, so a package-scoped affected entry may
not be expressible today. Even a correct summary plus the corrected version range in the
record would be an improvement over the current empty entry.

Additional context

CVSS 3.1 from NVD is 8.8 HIGH. A public exploit exists:
https://github.com/BobTheShoplifter/CVE-2023-52251-POC

Why this particular record seems worth fixing: the affected image has 447,220,745 pulls
on Docker Hub with status active, the upstream repository (12,278 stars, 1,411 forks) is
not archived and has had no commit since 2024-04-08, and its SECURITY.md still states
that 0.7.x is "currently being supported with security updates".

Meanwhile no database produces a matchable entry: the GitHub Advisory Database has no entry
for this CVE at all (checked reviewed, unreviewed and malware — zero hits), NVD
derives only cpe:2.3:a:provectus:ui:*:*:*:*:*:kafka:*:* with no version boundaries, and
this OSV entry has the empty package field described above. The practical result is that no
scanner reports this issue against the affected image.

This is not theoretical. An operator running provectuslabs/kafka-ui:latest at the digest
above, exposed without authentication, had the container used to run a cryptocurrency miner
for roughly 1.5 days, which resulted in an abuse report from their hosting provider. That
compromise happened on the exact version the published range does not list as affected.

References:

• Affected source at v0.7.2: https://github.com/provectus/kafka-ui/blob/v0.7.2/kafka-ui-api/src/main/java/com/provectus/kafka/ui/emitter/MessageFilters.java
• Fix in the fork: kafbat/kafka-ui@11a57d14
• Writeup: http://packetstormsecurity.com/files/177214/Kafka-UI-0.7.1-Command-Injection.html