Apache Flink - Arbitrary File Read (CVE-2020-17519)
Description
A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.
psychologyCrowdSec Analysis
CVE-2020-17519 is a vulnerability in Apache Flink that permits attackers to perform directory traversal via the JobManager REST interface, enabling unauthorized access to files on the local filesystem.
CrowdSec has been tracking this vulnerability and its exploits since 5th of June 2024.
CrowdSec network data shows that most actors exploiting CVE-2020-17519 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2020-17519 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2020-17519 is currently experiencing high visibility and active exploitation across the internet.
Observed attacks commonly attempt to access URLs containing /jobmanager/logs/...
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-01-05 |
| CISA KEV | 2024-05-23 |
| Rule Released | 2024-06-05 |
| CISA Remediation Deadline | 2024-06-13 |
| CrowdSec First Seen | 2024-11-24 |