CVE-2020-17518: Arbitrary File Upload in Apache Flink
Summary
CVE-2020-17518: Upload of file to arbitrary path in Apache Flink. Affects org.apache.flink:flink-runtime versions >= 1.5.1, < 1.11.3. Fixed in 1.11.3. How to fix ↓
Also tracked for
- flink · Bitnami
The same CVE-2020-17518 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Flink is an open-source stream processing framework that enables high-throughput, low-latency processing of big data. It provides distributed processing capabilities and fault tolerance, making it suitable for large-scale data processing tasks. However, a vulnerability in Apache Flink versions 1.5.1 to 1.11.2 allows for the arbitrary upload of files to any location accessible by Flink.
Vulnerability Detail
The vulnerability in Apache Flink 1.5.1 to 1.11.2 arises from a REST handler that permits the writing of uploaded files to arbitrary locations on the local file system. An attacker can exploit this by modifying the HTTP HEADER to specify a malicious file path. This can lead to unauthorized access, data leakage, or even remote code execution depending on the context in which Flink is deployed. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
1.11.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of Apache Flink.
Conclusion
The arbitrary file upload vulnerability in Apache Flink can have serious security implications, including unauthorized access and potential remote code execution. It is essential to upgrade to the latest patched version of Apache Flink (1.11.3 or 1.12.0) to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.flink:flink-runtime →
FAQ
Apache Flink is an open-source stream processing framework used for high-throughput, low-latency processing of big data.
The vulnerability allows for the arbitrary upload of files to any location accessible by Apache Flink, which can lead to unauthorized access, data leakage, or remote code execution.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
To fix this vulnerability, it is recommended to upgrade to Apache Flink version 1.11.3 or 1.12.0.
There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to a patched version of Apache Flink.
