CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
Authenticated attackers can achieve remote code execution on Apache StreamPark servers via FreeMarker template injection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-29178?
CVE-2024-29178 is a high-severity code injection vulnerability in Apache StreamPark, published on 18 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.
Mitigation:
all users should upgrade to 2.1.4
Weakness: CWE-94
Which versions are affected by CVE-2024-29178?
2 open source packages ship an affected version, including org.apache.streampark:streampark. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.apache.streampark:streampark Maven | All versions | 2.1.4 |
org.apache.streampark:streampark Maven | All versions | 2.1.4 |
Products include Apache Streampark.
How do I fix CVE-2024-29178?
Upgrade org.apache.streampark:streampark to 2.1.4 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-29178 being exploited?
There is no known exploitation of CVE-2024-29178 in the wild and no public exploit code.
Other vulnerabilities in Apache StreamPark
- CVE-2022-45802 Apache StreamPark (incubating): Upload any file to any directory
- CVE-2024-29070 Apache StreamPark: session not invalidated after logout
- CVE-2022-46365 Apache StreamPark (incubating): Logic error causing any account reset
- CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
- CVE-2024-29737 Apache StreamPark (incubating): maven build params could trigger remote command execution
Sources
Also known as GHSA-vv8h-m63v-53pq.