Arbitrary file read in Apache Flink JobManager REST interface

This is primarily a deliberately vulnerable training environment with a valid, manually documented CVE-2020-17519 proof of concept, not a standalone automated exploit. The JobManager log-file handler double-decodes filename input, allowing ..%252f components to escape the log directory and disclose files readable by the process. The guides demonstrate /etc/passwd disclosure; no execution, filesystem modification, or shell payload is included. The 32 supplied files comprise 24 code/configuration files when infrastructure and workflow YAML are included: seven Terraform modules, one Ruby Vagrantfile, five shell scripts, two Dockerfiles, and nine YAML/YML files. app/ contains the vendored English and Chinese walkthroughs and upstream compose configuration. base/ records the upstream image Dockerfile; build/flink/ wraps vulhub/flink:1.11.2 and selects the jobmanager command. isoloom.yml is the central lab specification. Generated .isoloom/ outputs support Docker, Kubernetes, Docker-hosting VMs, Proxmox, and six cloud providers. GitHub workflows validate generated infrastructure, run lab checks, and register approved labs using secret-configured backend endpoints whose actual addresses are not supplied. The generated lab publishes REST/dashboard port 8081 and keeps RPC port 6123 internal. Docker removes the Flink network namespace's default route; Kubernetes uses network policies to restrict egress. Cloud ingress is restricted by a user-supplied CIDR, while the Kubernetes LoadBalancer permits access to port 8081 without a source-CIDR restriction in the supplied manifest. The upstream app compose file publishes both service ports. checks/version.sh only verifies the reported version and log-listing endpoint. Generated checks test dashboard availability and blocked internet access; none sends the traversal payload, so successful checks do not independently prove exploitation. CTF metadata requests flag retrieval, but no flag file, flag path, or flag-generation mechanism appears in the supplied files. The README image reference 1.png is also absent. Cleanup commands in CI and provisioning have ordinary maintenance purposes and do not indicate a fake exploit. Isoloom is deployment tooling, not an exploit framework. The original analyzed repository URL, analyzed git reference, and archive size were not supplied; empty strings and zero represent unavailable metadata. The stated upstream commit is provenance, not the analyzed repository reference.

This repository contains a Metasploit auxiliary module (apache_flink_file_read.rb) that exploits an unauthenticated directory traversal vulnerability (CVE-2020-17519) in Apache Flink versions 1.11.0, 1.11.1, and 1.11.2. The exploit allows remote attackers to read arbitrary files from the server with the privileges of the web server user by sending a crafted HTTP GET request to the Flink web interface, specifically targeting the /jobmanager/logs endpoint with directory traversal sequences. The module is operational and provides file read capabilities, demonstrated by reading /etc/passwd. The README.md provides usage instructions, affected versions, and references. No hardcoded IPs or domains are present; the exploit is configurable for target host, port, file path, and traversal depth.

This repository contains a single Metasploit auxiliary scanner module targeting a directory traversal vulnerability (CVE-2020-17519) in Apache Flink JobManager REST API (versions 1.11.0 to 1.11.2). The module allows an unauthenticated attacker to read arbitrary files from the server by exploiting improper validation of user-supplied log file paths. The exploit works by sending a crafted HTTP GET request to the '/jobmanager/logs/<traversal>' endpoint, where the traversal string is constructed to access files outside the intended directory. The module also includes a check method to verify if the target is running a vulnerable version of Apache Flink by querying the '/config' endpoint. The code is written in Ruby and is designed to be used within the Metasploit framework. The exploit is operational, providing file read capabilities but not remote code execution. The only file in the repository is the Metasploit module itself.

This repository contains a Python exploit script (CVE-2020-17519.py) targeting the directory traversal vulnerability in Apache Flink's JobManager web interface (CVE-2020-17519). The exploit allows an attacker to read arbitrary files from the server by sending specially crafted HTTP GET requests to the /jobmanager/logs/ endpoint, using double-encoded traversal sequences (..%252f) and user-supplied file paths. The script supports single or multiple file path requests, multi-threading, proxy configuration, and can save valid responses to disk. The README provides usage instructions and example commands. The exploit is operational and can be used to extract sensitive files from vulnerable Apache Flink instances accessible over the network.

This repository provides a Python-based tool for testing Apache HTTP Server and Apache Flink installations for path traversal vulnerabilities (CVE-2021-41773, CVE-2021-42013, CVE-2020-17519). The main script (main.py) orchestrates multi-threaded HTTP(S) requests to a list or range of target IPs, using a set of crafted path traversal payloads defined in assets/exploits.json. The tool attempts to access sensitive files (such as /etc/passwd) by exploiting improper input validation in vulnerable servers. Results are logged to output files, with successful exploitation attempts recorded in output/vuln.txt. The codebase is modular, with separate modules for threading, HTTP requests, file handling, and optional Shodan integration. The tool is operational and can be used to automate the detection and exploitation of these specific path traversal vulnerabilities across multiple targets.