[CVE-2020-17519] Apache Flink RESTful API Arbitrary File Read

Apache Flink is a framework and distributed processing engine for stateful computations over unbounded and bounded data streams which developed using Java and Scala. A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the RESTful API of the JobManager process. Access to filesystem is restricted to files accessible by the JobManager process.

While all versions between 1.11.0 - 1.11.2 are affected the related vulnerability, Apache Flink has fixed vulnerability for versions 1.11.3 and above.

Vulnerable code is src/main/java/org/apache/flink/runtime/rest/handler/cluster/JobManagerCustomLogHandler.java class. Related code snippet is down below.

		if (logDir == null) {
			return null;
		}
		String filename = handlerRequest.getPathParameter(LogFileNamePathParameter.class);
		return new File(logDir, filename);
	}
}

The problem is that the request handler enables to direct access to file path. With this commit, vulnerable line of code has been changed as below. In the code snippet below, the vulnerable line is marked as comment line.

CVE-2020-17519

Most Popular