Apache Flink directory traversal attack: reading remote files through the REST API
100Vexday Risk Score
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
ssvc Actcvss 9.1epss 98%
from disclosure to weapon1 days
Published on NVDJan 5
1st PoC+1d
metasploitJan 5
CISA KEV+1234d
exploitation probability
98%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
26 public exploit(s)
What the vendors declare (VEX)
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Red HatVEX document ↗
Not affected
2 products — because the vulnerable code is not present in the product
Red Hat Fuse 7 · Red Hat Integration Camel K 1
Action required by CISAfederal deadline: 2024-06-13
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Researched and written with AI from the vendor advisory and public analysis, with the sources above. Always confirm the fixed version in the official advisory before acting.
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Affected products
Apache Software Foundation · Apache Flinkpublic PoCs found — 26✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/49398githubgithub.com/MrCl0wnLab/SimplesApachePathTraversal★ 61githubgithub.com/B1anda0/CVE-2020-17519★ 48githubgithub.com/murataydemir/CVE-2020-17519★ 8githubgithub.com/dolevf/apache-flink-directory-traversal.nse★ 3githubgithub.com/yaunsky/CVE-2020-17519-Apache-Flink★ 1githubgithub.com/QmF0c3UK/CVE-2020-17519★ 1githubgithub.com/givemefivw/CVE-2020-17519★ 1githubgithub.com/dev-team-12x/CVE-2020-17519★ 0githubgithub.com/radbsie/CVE-2020-17519-Exp★ 0githubgithub.com/zhangweijie11/CVE-2020-17519★ 0githubgithub.com/shoucheng3/apache__flink_CVE-2020-17519_1-11-2★ 0githubgithub.com/Osyanina/westone-CVE-2020-17519-scanner★ 0githubgithub.com/GazettEl/CVE-2020-17519★ 0vulncheckvulncheck.com/xdb/a0b10abc1d63unverifiedvulncheckvulncheck.com/xdb/c096ce6f775bunverifiedvulncheckvulncheck.com/xdb/259c72303ba8unverifiedvulncheckvulncheck.com/xdb/02f7b73ab684unverifiedvulncheckvulncheck.com/xdb/5060de9f4f15unverifiedvulncheckvulncheck.com/xdb/50a45f679975unverifiedvulncheckvulncheck.com/xdb/9be1f64fbcd2unverifiedvulncheckvulncheck.com/xdb/1620553c643aunverifiedcve_referencepacketstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.htmlunverifiedvulncheckvulncheck.com/xdb/7fe03bf0f0a6unverifiedvulncheckvulncheck.com/xdb/7c9fe2b962fdunverifiedvulncheckvulncheck.com/xdb/1b1d6d820b0cunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.htmlhttps://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e0ead341c901216f292d2bbe83%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3Cdev.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049bd1c49fd92b518309aa85a0398%40%3Cissues.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe56119200ed25bdab0eb80d664fa5bfe2%40%3Cdev.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.apache.org%3Ehttps://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flink.apache.org%3Ehttps://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aaef4b77060b56557a243abb92a1%40%3Cissues.flink.apache.org%3E