PT-2025-16173 · Apache · Apache Seatunnel

Liyiwei + 1 · Published 2025-04-12 · Updated 2025-06-20 · CVE-2025-32896

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache SeaTunnel versions <=2.3.10

Description Unauthorized users can perform Arbitrary File Read and Deserialization attack by submitting a job using the restful api-v1. An attacker can access the /hazelcast/rest/maps/submit-job endpoint to submit a job and set extra parameters in the MySQL URL to perform the attack.

Recommendations For Apache SeaTunnel versions <=2.3.10, users are recommended to upgrade to version 2.3.11 and enable restful api-v2 and open https two-way authentication, which fixes the issue. As a temporary workaround, consider restricting access to the /hazelcast/rest/maps/submit-job endpoint until the issue is resolved.

Fix

RCE

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

BDU:2025-05056

CVE-2025-32896

GHSA-9X53-GR7P-4QF5

Affected Products

Apache Seatunnel

References · 22

• https://github.com/apache/seatunnel/pull/9010 · Patch
• https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32896 · Security Note
• https://osv.dev/vulnerability/GHSA-9x53-gr7p-4qf5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05056 · Security Note
• https://github.com/apache/seatunnel/commit/53325aa3e76e3939f41a4bf3eaaf3ee56f13f311 · Note
• https://github.com/apache/seatunnel · Note
• https://t.me/purp_sec/504 · Telegram Post
• https://twitter.com/Dinosn/status/1911268394294231215 · Twitter Post
• https://twitter.com/fletch_ai/status/1912038320584237559 · Twitter Post
• https://twitter.com/oss_security/status/1911066896452944203 · Twitter Post
• https://twitter.com/dailytechonx/status/1936204919612002393 · Twitter Post
• https://lists.apache.org/thread/s2dw28t4p0q6t3k0qoqnm18t6pt04pyt · Note
• https://twitter.com/CVEnew/status/1935723252271436042 · Twitter Post