CVE-2020-17518observed exploitationCWE-23

Apache Flink directory traversal attack: remote file writing through the REST API

72Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actepss 50%

from disclosure to weapon1 days

Published on NVDJan 5

1st PoC+1d

VulnCheck+1054d

exploitation probability

50%top 1% of all CVEs

observed exploitation

yesVulnCheck

3 public exploit(s)

Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.

Affected products

Apache Software Foundation · Apache Flink

public PoCs found — 3

vulncheckvulncheck.com/xdb/cbd3d87ea7d5unverified vulncheckvulncheck.com/xdb/03b52e0c11e3unverified vulncheckvulncheck.com/xdb/d75c5445c328unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References