PT-2024-5250 · Apache · Apache Streampark

L0Ne1Y · Published 2024-07-17 · Updated 2024-08-01 · CVE-2024-29737

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Apache StreamPark versions prior to 2.1.4

Description: The issue is related to incorrect handling of the ` character in the Project Module of Apache StreamPark, allowing remote attackers to execute arbitrary commands. The vulnerability can be exploited if an attacker has system-level permissions and is logged in to the StreamPark system. The risk level of this vulnerability is considered low, as it typically requires authorization to log in to the system and users would not manually input dangerous operation commands.

Recommendations: For versions prior to 2.1.4, upgrade to version 2.1.4 to resolve the issue. As a temporary workaround, consider restricting access to the Project module or limiting the use of the ` character in build arguments to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-05862

CVE-2024-29737

GHSA-5V69-92VW-FMJH

Affected Products

Apache Streampark

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-29737 · Security Note
• https://bdu.fstec.ru/vul/2024-05862 · Security Note
• https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5v69-92vw-fmjh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-29737 · Vendor Advisory
• https://github.com/apache/streampark · Note
• http://openwall.com/lists/oss-security/2024/07/17/2 · Note
• https://t.me/cvedetector/1074 · Telegram Post