PT-2024-13693 · Apache · Apache Seatunnel

Jiahua Huang · Published 2024-08-21 · Updated 2024-08-25 · CVE-2023-49198

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache SeaTunnel version 1.0.0

Description A security issue in Apache SeaTunnel allows attackers to read files on the MySQL server by modifying the information in the MySQL URL. The issue can be exploited by setting specific parameters in the MySQL URL, such as allowLoadLocalInfile=true, allowUrlInLocalInfile=true, allowLoadLocalInfileInPath=/, and maxAllowedPacket=655360. This allows for arbitrary file read vulnerability.

Recommendations For Apache SeaTunnel version 1.0.0, upgrade to version 1.0.1, which fixes the issue. As a temporary workaround, consider restricting access to the MySQL URL handler to minimize the risk of exploitation. Avoid using the parameters allowLoadLocalInfile, allowUrlInLocalInfile, allowLoadLocalInfileInPath, and maxAllowedPacket in the affected API endpoint until the issue is resolved.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2023-49198

GHSA-8M84-H9HH-3CFH

Affected Products

Apache Seatunnel

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2023-49198 · Security Note
• https://osv.dev/vulnerability/CVE-2023-49198 · Vendor Advisory
• https://lists.apache.org/thread/48j9f1nsn037mgzc4j9o51nwglb1s08h · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8m84-h9hh-3cfh · Vendor Advisory
• https://github.com/apache/seatunnel · Note
• https://twitter.com/VulmonFeeds/status/1826235489692627004 · Twitter Post
• https://twitter.com/oss_security/status/1826225545170087975 · Twitter Post
• https://twitter.com/CVEnew/status/1826234678107660695 · Twitter Post
• https://twitter.com/cracbot/status/1827949156100636782 · Twitter Post
• https://t.me/cvenotify/91973 · Telegram Post
• http://openwall.com/lists/oss-security/2024/08/21/2 · Note
• https://twitter.com/oktsec/status/1826155848751600027 · Twitter Post
• https://t.me/cvenotify/91473 · Telegram Post
• https://twitter.com/Infosec_techs/status/1826858003242377347 · Twitter Post
• https://t.me/cvedetector/3764 · Telegram Post