# CVE-2020-17519: Apache Flink - Arbitrary File Read

> Live exploitation tracking for CVE-2020-17519 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2020-17519

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.1
- **Public exploit available:** Yes
- **Affected products:** Apache Flink
- **Weaknesses:** CWE-552 (Files or Directories Accessible to External Parties)

## Description

A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

## CrowdSec analysis

[CVE-2020-17519](https://euvd.enisa.europa.eu/vulnerability/CVE-2020-17519) is a vulnerability in Apache Flink that permits attackers to perform directory traversal via the JobManager REST interface, enabling unauthorized access to files on the local filesystem.

CrowdSec has been tracking this vulnerability and its exploits since 5th of June 2024.

CrowdSec network data shows that most actors exploiting CVE-2020-17519 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2020-17519 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2020-17519 is currently experiencing high visibility and active exploitation across the internet.

Observed attacks commonly attempt to access URLs containing `/jobmanager/logs/..`.

## Timeline

- 2021-01-05: CVE Published. CVE-2020-17519 is published to NVD.
- 2024-05-23: CISA KEV. CVE-2020-17519 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-06-05: Rule Released. CrowdSec releases a rule to detect CVE-2020-17519 exploitation attempts against the CrowdSec Network.
- 2024-06-13: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-24: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2020-17519 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-17519.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2020-17519) follows observed exploitation activity for CVE-2020-17519. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.