CVE-2024-29070 Apache StreamPark: session not invalidated after logout
Attackers can access data using stale session tokens after logout due to improper session invalidation in Apache StreamPark.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-29070?
CVE-2024-29070 is a critical authentication bypass vulnerability in Apache StreamPark, published on 23 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On versions before 2.1.4, session is not invalidated after logout. When the user logged in successfully, the Backend service returns "Authorization" as the front-end authentication credential. "Authorization" can still initiate requests and access data even after logout.
Mitigation:
all users should upgrade to 2.1.4
Weakness: CWE-613
Which versions are affected by CVE-2024-29070?
It affects 1 product.
Products include Apache Streampark.
How do I fix CVE-2024-29070?
No fix has been published for CVE-2024-29070 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-29070 being exploited?
There is no known exploitation of CVE-2024-29070 in the wild and no public exploit code.
Other vulnerabilities in Apache StreamPark
- CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory
- CVE-2022-46365 Apache StreamPark (incubating): Logic error causing any account reset
- CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
- CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution
Sources
Also known as GHSA-fprx-3cv4-96vc.