CVE-2020-17519 Apache Flink Improper Access Control
Attackers can read arbitrary files on the JobManager filesystem via the REST API, exposing sensitive data to unauthorized users.
- Exploited in the wild
- Since 23 May 2024
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-17519?
CVE-2020-17519 is a critical path traversal vulnerability in Apache Flink, published on 5 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
Weakness: CWE-552
Which versions are affected by CVE-2020-17519?
5 open source packages ship an affected version, including org.apache.flink:flink-runtime_2.11, flink and org.apache.flink:flink-runtime_2.12. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.flink:flink-runtime_2.11 Maven | From 1.11.0 | 1.11.3 |
org.apache.flink:flink-runtime_2.11 Maven | From 1.11.0 | 1.11.3 |
flink Bitnami | From 1.11.0 | 1.11.3 |
org.apache.flink:flink-runtime_2.12 Maven | From 1.11.0 | 1.11.3 |
org.apache.flink:flink-runtime_2.12 Maven | From 1.11.0 | 1.11.3 |
Products include Apache Flink.
How do I fix CVE-2020-17519?
Upgrade org.apache.flink:flink-runtime_2.11 to 1.11.3 or later. US federal agencies must fix it by 13 Jun 2024.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-17519 being exploited?
Yes. Attackers have exploited CVE-2020-17519 in the wild since at least 23 May 2024.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 14 proofs of concept on GitHub.
Other vulnerabilities in Apache Flink
Sources
Also known as BIT-flink-2020-17519, GHSA-395w-qhqr-9fr6.