CVE-2020-17518
HIGH EXPLOITED NUCLEIApache Flink <1.11.3-1.12.0 - Path Traversal
Title source: llmExploitation Summary
CVE-2020-17518 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including QmF0c3UK, murataydemir, rakjong. A Nuclei detection template is also available.
AI-analyzed exploit summary This PoC exploits CVE-2020-17518, a directory traversal vulnerability in Apache Flink's REST API, allowing arbitrary file write via malicious HTTP headers. The script checks for vulnerability by attempting to write a test file to a traversed path.
Description
Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.
Exploits (3)
This PoC exploits CVE-2020-17518, a directory traversal vulnerability in Apache Flink's REST API, allowing arbitrary file write via malicious HTTP headers. The script checks for vulnerability by attempting to write a test file to a traversed path.
This repository contains a valid proof-of-concept for CVE-2020-17518, an arbitrary file upload vulnerability in Apache Flink via directory traversal. The PoC demonstrates how an attacker can upload files to arbitrary directories on the local filesystem by crafting HTTP requests with malicious filenames.
This PoC exploits CVE-2020-17518 in Apache Flink by uploading a malicious JAR file to achieve remote code execution. It leverages a directory traversal vulnerability to place the JAR in a predictable location and provides a command execution endpoint.
Nuclei Templates (1)
References (24)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N