Loading vulnerability…
CVE-2020-17519 is a directory traversal and arbitrary file read vulnerability in Apache Flink affecting versions 1.11.0, 1.11.1, and 1.11.2. A change introduced in Flink 1.11.0 allowed an attacker to use the JobManager REST interface to read files from the local filesystem of the JobManager host. The exposure is limited to files that are accessible to the operating-system account running the JobManager process, but it can still disclose sensitive local data to remote attackers when the REST interface is reachable.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a Metasploit auxiliary module (apache_flink_file_read.rb) that exploits an unauthenticated directory traversal vulnerability (CVE-2020-17519) in Apache Flink versions 1.11.0, 1.11.1, and 1.11.2. The exploit allows remote attackers to read arbitrary files from the server with the privileges of the web server user by sending a crafted HTTP GET request to the Flink web interface, specifically targeting the /jobmanager/logs endpoint with directory traversal sequences. The module is operational and provides file read capabilities, demonstrated by reading /etc/passwd. The README.md provides usage instructions, affected versions, and references. No hardcoded IPs or domains are present; the exploit is configurable for target host, port, file path, and traversal depth.
This repository contains a single Metasploit auxiliary scanner module targeting a directory traversal vulnerability (CVE-2020-17519) in Apache Flink JobManager REST API (versions 1.11.0 to 1.11.2). The module allows an unauthenticated attacker to read arbitrary files from the server by exploiting improper validation of user-supplied log file paths. The exploit works by sending a crafted HTTP GET request to the '/jobmanager/logs/<traversal>' endpoint, where the traversal string is constructed to access files outside the intended directory. The module also includes a check method to verify if the target is running a vulnerable version of Apache Flink by querying the '/config' endpoint. The code is written in Ruby and is designed to be used within the Metasploit framework. The exploit is operational, providing file read capabilities but not remote code execution. The only file in the repository is the Metasploit module itself.
This repository contains a Python exploit script (CVE-2020-17519.py) targeting the directory traversal vulnerability in Apache Flink's JobManager web interface (CVE-2020-17519). The exploit allows an attacker to read arbitrary files from the server by sending specially crafted HTTP GET requests to the /jobmanager/logs/ endpoint, using double-encoded traversal sequences (..%252f) and user-supplied file paths. The script supports single or multiple file path requests, multi-threading, proxy configuration, and can save valid responses to disk. The README provides usage instructions and example commands. The exploit is operational and can be used to extract sensitive files from vulnerable Apache Flink instances accessible over the network.
This repository provides a Python-based tool for testing Apache HTTP Server and Apache Flink installations for path traversal vulnerabilities (CVE-2021-41773, CVE-2021-42013, CVE-2020-17519). The main script (main.py) orchestrates multi-threaded HTTP(S) requests to a list or range of target IPs, using a set of crafted path traversal payloads defined in assets/exploits.json. The tool attempts to access sensitive files (such as /etc/passwd) by exploiting improper input validation in vulnerable servers. Results are logged to output files, with successful exploitation attempts recorded in output/vuln.txt. The codebase is modular, with separate modules for threading, HTTP requests, file handling, and optional Shodan integration. The tool is operational and can be used to automate the detection and exploitation of these specific path traversal vulnerabilities across multiple targets.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A directory traversal / arbitrary file read vulnerability in Apache Flink's JobManager REST API that allows attackers to read files on the local filesystem accessible to the JobManager process.
Apache Flink vulnerability referenced as an older CVE with consistently high EPSS and historical in-the-wild exploitation, used to discuss EPSS predictive value.
A known Apache Flink security vulnerability mentioned as one of several recently known flaws that were fixed in Flink 1.12.2-rc2.
An Apache Flink vulnerability described as arbitrary read/write remote code execution, with proof-of-concept or Metasploit exploit code released.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.