Loading vulnerability…
Apache Flink REST API Arbitrary File Write
CVE-2020-17518 is a relative path traversal vulnerability in Apache Flink's REST upload handling. A REST handler introduced in Flink 1.5.1 improperly handles attacker-controlled path information supplied through a maliciously modified HTTP header, allowing an uploaded file to be written to an arbitrary local filesystem location rather than its intended upload location. Apache Flink versions 1.5.1 through 1.11.2 are affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
A remote attacker can write an attacker-controlled uploaded file to any filesystem location writable by the Flink process. The resulting impact depends on the process privileges and writable paths; it can enable overwrite or placement of application data, configuration, scripts, or other files, potentially leading to service compromise or code execution when a written file is later consumed or executed.
If you can’t patch tonight, do this now.
Do not expose Flink REST endpoints to untrusted networks or the public internet. Restrict access to trusted administrative users and networks using network segmentation, firewall or reverse-proxy access controls, and authentication controls where available. Run Flink using a least-privileged service account and restrict write permissions to only required directories to reduce the impact of arbitrary file placement.
Patch, then assume compromise.
Upgrade Apache Flink to version 1.11.3, 1.12.0, or a later supported release. Apply the corresponding vendor-provided update for products that bundle affected Flink components.
No validated public exploits yet. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.