Log in Start free

Actively exploited · Published Jan 5, 2021 · Assigned by apache

CVE-2020-17519Apache Flink directory traversal attack: reading remote files through the REST API

Critical 9.1 Exploited

In plain English

A critical-severity security flaw in Apache Flink from Apache Software Foundation. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2024). The chance it is exploited in the next 30 days is estimated at 98.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.1Critical
Exploit odds (30 days)98.0%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since May 23, 2024
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Federal agencies must remediate by Jun 13, 2024.

Official description

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.apache.flink:flink-runtime_2.111.11.3GHSA-395w-qhqr-9fr6
Mavenorg.apache.flink:flink-runtime_2.121.11.3GHSA-395w-qhqr-9fr6

Affected products (as reported)

VendorProductVersions
Apache Software Foundation Apache Flink Apache Flink 1.11.0 to 1.11.2

Weakness: CWE-552 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

References