CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload

What is CVE-2024-31411?

CVE-2024-31411 is a medium-severity vulnerability in Apache StreamPipes, published on 17 Jul 2024. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Unrestricted Upload of File with dangerous type vulnerability in Apache StreamPipes. Such a dangerous type might be an executable file that may lead to a remote code execution (RCE). The unrestricted upload is only possible for authenticated and authorized users. This issue affects Apache StreamPipes: through 0.93.0.

Users are recommended to upgrade to version 0.95.0, which fixes the issue.

Weakness: CWE-434

Which versions are affected by CVE-2024-31411?

5 open source packages ship an affected version, including org.apache.streampipes:streampipes-parent and streampipes. It affects 1 product.

Products include Apache Streampipes.

How do I fix CVE-2024-31411?

Upgrade org.apache.streampipes:streampipes-parent to 0.95.0 or later.

Is CVE-2024-31411 being exploited?

There is no known exploitation of CVE-2024-31411 in the wild and no public exploit code.

Other vulnerabilities in Apache StreamPipes

• CVE-2024-29868 Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation Critical 9.1
• CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user High 8.8
• CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation High 8.1
• CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process High 7.5
• CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6523-jf4r-c962, PYSEC-2024-173.