CVE-2020-17518 Apache Flink directory traversal attack: remote file writing through the REST API
Attackers can write files to arbitrary locations on the server via the REST API, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17518?
CVE-2020-17518 is a high-severity path traversal vulnerability in Apache Flink, published on 5 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Which versions are affected by CVE-2020-17518?
3 open source packages ship an affected version, including org.apache.flink:flink-runtime and flink. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.flink:flink-runtime Maven | From 1.5.1 | 1.11.3 |
org.apache.flink:flink-runtime Maven | From 1.5.1 | 1.11.3 |
flink Bitnami | From 1.5.1 | 1.11.3 |
Products include Apache Flink.
How do I fix CVE-2020-17518?
Upgrade org.apache.flink:flink-runtime to 1.11.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-17518 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-17518 exists.
Public exploit code: 1 Nuclei template and 3 proofs of concept on GitHub.
Other vulnerabilities in Apache Flink
Sources
Also known as BIT-flink-2020-17518, GHSA-7q5g-gph2-4rc6.