Command injection in Apache Flink

A vulnerability in Apache Flink where, when running a process with an enabled JMXReporter, with a port configured via metrics.reporter.reportername.port, an attacker with local access to the machine and JMX port can execute a man-in-the-middle attack using a specially crafted request to rebind th...

VulnCheck KEV: CVE-2020-17519

Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local filesystem of the JobManager through its REST interface...

Apache Flink Remote Code Execution

A remote code execution vulnerability exists in Apache Flink. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Metasploit Wrap-Up

Hey who finked about Flink? In this week's round of modules, contributor bcoles offered up two modules to leverage that Apache Flink install you found in some fun new ways. If you are just looking to filch a few files, auxiliary/scanner/http/apacheflinkjobmanagertraversal leverages CVE-2020-17519...

Apache Flink JAR Upload Java Code Execution

This module uses job functionality in Apache Flink dashboard web interface to upload and execute a JAR file, leading to remote execution of arbitrary Java code as the web server user. This module has been tested successfully on Apache Flink versions: 1.9.3 on Ubuntu 18.04.4; 1.11.2 on Ubuntu...

Apache Flink JobManager Traversal

This module exploits an unauthenticated directory traversal vulnerability in Apache Flink versions 1.11.0 use auxiliary/scanner/http/apacheflinkjobmanagertraversal msf auxiliaryapacheflinkjobmanagertraversal show actions ...actions... msf auxiliaryapacheflinkjobmanagertraversal set ACTION msf...

Apache Flink JAR Upload Java Code Execution Exploit

This Metasploit module uses job functionality in the Apache Flink dashboard web interface to upload and execute a JAR file, leading to remote execution of arbitrary Java code as the web server user. This module has been tested successfully on Apache Flink versions: 1.9.3 on Ubuntu 18.04.4; 1.11.2...

Apache Flink JAR Upload Java Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink JAR Upload Java Code Execution', 'Description' = %q This module uses job functionality in Apache Flink dashboard web interface to...

Apache Flink Web UI Detection

Binary data apacheflinkwebuidetect.nbin...

Apache Flink local file inclusion Vulnerability (direct check)

Binary data apacheflinkcve-2020-17519.nbin...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

CVE-2020-17519 Apache Flink Arbitrary File Reading Vulnerabil...

Apache Flink Directory Traversal (CVE-2020-17518; CVE-2020-17519)

A directory traversal vulnerability exists in Apache Flink. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

CVE-2020-17519 Apache Flink RESTful API Arbitrary File Read -...

Exploit for Path Traversal in Apache Flink

CVE-2020-17518 Apache Flink RESTful API Arbitrary File Upload...

Directory Traversal

flink-runtime in vulnerable to Directory Traversal. An attacker is able to read any file accessible by the JobManager process on the local filesystem of the JobManager through the RES interface of the JobManager process...

Exploit for Files or Directories Accessible to External Parties in Apache Flink

Vulnerable Application This module exploits an unauthenticate...

Apache Flink suffers from an arbitrary file read vulnerability (CNVD-2021-03406)

Apache Flink is efficient and distributed general purpose data processing platform. Apache Flink suffers from an arbitrary file read vulnerability that can be exploited by an attacker to obtain sensitive information...

Apache Flink 1.11.0 Arbitrary File Read / Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Fli...

Apache Flink Directory Traversal

Directory traversal vulnerability in Apache Flink Vulnerability Type: File Disclosure For the exploit source code contact DSquare Security sales team...

Apache Flink 1.11.0 - Unauthenticated Arbitrary File Read (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Apache Flink File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Apache Fli...