CVE-2020-17519
Apache Flink Improper Access Control Vulnerability
Description
CVE-2020-17519 is a high-severity directory traversal vulnerability in Apache Flink versions 1.11.0 through 1.11.2 that allows unauthenticated attackers to read arbitrary files on the local filesystem of the JobManager through its REST interface. With a CVSS v3.1 base score of 7.5, the vulnerability provides network-accessible file read access restricted only by the permissions of the JobManager process. CISA has added CVE-2020-17519 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2024, and the ransomware association is currently unknown. Its EPSS score of 94.38% at the 100th percentile places it among the most actively exploited vulnerabilities worldwide, reflecting years of sustained exploitation against exposed Apache Flink instances.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| apache | flink | >= 1.11.0, < 1.11.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References
- http://packetstormsecurity.com/files/160849/Apache-Flink-1.11.0-Arbitrary-File-Read-Directory-Traversal.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2021/01/05/2(Mailing List, Third Party Advisory)
- https://lists.apache.org/thread.html/r0a433be10676f4fe97ca423d08f914e0ead341c901216f292d2bbe83%40%3Cissues.flink.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r1125f3044a0946d1e7e6f125a6170b58d413ebd4a95157e4608041c7%40%3Cannounce.apache.org%3E(Mailing List)
- https://lists.apache.org/thread.html/r229167538863518738e02f4c1c5a8bb34c1d45dadcc97adf6676b0c1%40%3Cdev.flink.apache.org%3E(Issue Tracking)
- https://lists.apache.org/thread.html/r26fcdd4fe288323006253437ebc4dd6fdfadfb5e93465a0e4f68420d%40%3Cuser-zh.flink.apache.org%3E(Issue Tracking)
- https://lists.apache.org/thread.html/r28f17e564950d663e68cc6fe75756012dda62ac623766bb9bc5e7034%40%3Cissues.flink.apache.org%3E(Issue Tracking)
- https://lists.apache.org/thread.html/r2fc60b30557e4a537c2a6293023049bd1c49fd92b518309aa85a0398%40%3Cissues.flink.apache.org%3E(Issue Tracking)
- https://lists.apache.org/thread.html/r4e1b72bfa789ea5bc20b8afe56119200ed25bdab0eb80d664fa5bfe2%40%3Cdev.flink.apache.org%3E(Mailing List, Vendor Advisory)
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cannounce.apache.org%3E(Mailing List, Vendor Advisory)
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cdev.flink.apache.org%3E(Mailing List, Vendor Advisory)
- https://lists.apache.org/thread.html/r6843202556a6d0bce9607ebc02e303f68fc88e9038235598bde3b50d%40%3Cuser.flink.apache.org%3E(Issue Tracking)
- https://lists.apache.org/thread.html/r88b55f3ebf1f8f4e1cc61f030252aaef4b77060b56557a243abb92a1%40%3Cissues.flink.apache.org%3E(Mailing List, Vendor Advisory)
- https://lists.apache.org/thread.html/r88f427865fb6aa6e6378efe07632a1906b430365e15e3b9621aabe1d%40%3Cissues.flink.apache.org%3E(Mailing List, Vendor Advisory)
- https://lists.apache.org/thread.html/r90890afea72a9571d666820b2fe5942a0a5f86be406fa31da3dd0922%40%3Cannounce.apache.org%3E(Mailing List, Not Applicable)
- https://lists.apache.org/thread.html/ra8c96bf3ccb4e491f9ce87ba35f134b4449beb2a38d1ce28fd89001f%40%3Cdev.flink.apache.org%3E(Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-17519(US Government Resource)
Weakness Type
Path Traversal via REST Interface
CVE-2020-17519 is a directory traversal vulnerability in the Apache Flink JobManager's REST interface. The vulnerability was introduced in Apache Flink 1.11.0 through a code change that inadvertently allowed path traversal sequences in REST API requests targeting the JobManager process. An attacker can send crafted HTTP requests containing directory traversal characters (such as ../) to escape the intended file access scope and read arbitrary files from the filesystem. The vulnerability is accessible without authentication, and the only limitation is the filesystem permissions of the user running the JobManager process. Directory traversal in data processing platforms like Apache Flink is particularly dangerous because these systems often run with broad file access permissions and may have access to sensitive configuration files, credentials, and data stored on the processing nodes. Learn more about path traversal vulnerabilities at CWE-22.
Impact Analysis
The impact of CVE-2020-17519 is significant, with the CVSS vector reflecting complete confidentiality compromise through a trivially exploitable network attack. Confidentiality is fully compromised because the arbitrary file read capability grants the attacker access to any file readable by the Flink JobManager process. This includes Flink configuration files that may contain database credentials, AWS access keys, Hadoop credentials, Kerberos keytabs, and connection strings to data stores. In big data environments, these credentials often provide access to vast amounts of sensitive data across the entire data processing infrastructure.
While the CVSS vector shows no direct integrity (I:N) or availability (A:N) impact, the practical consequences of credential extraction can be devastating. Stolen database credentials or cloud access keys extracted through this vulnerability can enable full read-write access to data lakes, data warehouses, and message queues that the Flink cluster processes. The network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N) make exploitation trivial and fully automatable. The extraordinary EPSS score of 94.38% at the 100th percentile demonstrates that despite being disclosed in late 2020, this vulnerability continues to be mass-exploited against exposed Flink instances, driven by the widespread use of Apache Flink in enterprise data processing pipelines and the availability of reliable public exploits.
Exploit Maturity
CVE-2020-17519 has reached maximum exploit maturity with publicly available exploits, mass scanning activity, and sustained active exploitation since its disclosure in January 2021. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2024, confirming ongoing exploitation more than three years after the vulnerability was first reported.
The EPSS score of 94.38% at the 100th percentile confirms that this vulnerability is among the most targeted in the global threat landscape. A ready-to-use exploit was published on PacketStorm Security, and the vulnerability details were discussed on the oss-security mailing list. The fix was announced by the Apache Flink project through their dev mailing list, recommending an upgrade to Flink 1.11.3 or 1.12.0.
The ransomware association remains unknown, but the ability to extract credentials from Flink configurations makes this vulnerability a valuable reconnaissance and lateral movement tool for attackers targeting big data environments. Automated scanners routinely probe for exposed Flink JobManager interfaces on default ports.
Remediation
-
Upgrade Apache Flink to version 1.11.3 or 1.12.0 or later immediately. The vulnerability was fixed in these releases. Given the age of the affected versions, strongly consider upgrading to the latest supported Flink release to benefit from all subsequent security improvements.
-
Restrict network access to the Flink JobManager REST interface. The JobManager REST interface should never be directly accessible from the internet or untrusted networks. Place the Flink cluster behind a firewall or reverse proxy and restrict access to authorized administrators and application components only.
-
Implement authentication on the Flink REST interface. Configure Flink's security settings to require authentication for REST API access. Enable SSL/TLS for the REST interface to protect communications. In production environments, integrate Flink with your organization's identity management system.
-
Rotate all credentials stored in Flink configuration files. If the Flink JobManager was accessible from untrusted networks while running a vulnerable version, assume that all credentials in Flink configuration files have been compromised. Rotate database passwords, cloud access keys, Kerberos keytabs, and any other secrets that the Flink cluster was configured to use.
-
Audit network logs for exploitation attempts. Search web server and reverse proxy logs for HTTP requests containing directory traversal patterns (../) targeting the Flink REST API endpoints. Any evidence of successful file reads should trigger a full incident response to determine what data was accessed and which credentials may have been compromised.
Technical Details
CVE-2020-17519 is a directory traversal vulnerability in Apache Flink with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, resulting in a high base score of 7.5. The network attack vector (AV:N) means the vulnerability is exploitable from anywhere that can reach the Flink JobManager REST interface. The low attack complexity (AC:L), no privileges required (PR:N), and no user interaction needed (UI:N) make exploitation trivial and fully automatable with simple HTTP requests.
The vulnerability was introduced in Apache Flink 1.11.0 through a change in how the JobManager REST interface handles file access requests. The REST API includes endpoints that serve files, and the 1.11.0 release introduced a regression that failed to properly sanitize path components in incoming requests. An attacker can craft HTTP requests with directory traversal sequences (e.g., ..%252f or similar encoded path traversal patterns) that escape the intended directory scope and traverse the local filesystem of the server running the JobManager process.
The scope is unchanged (S:U), with the impact limited to the filesystem permissions of the Flink JobManager process. However, since Flink is a data processing framework that typically runs with broad filesystem access and stores credentials for multiple data sources in its configuration, the confidentiality impact (C:H) is high. Integrity (I:N) and availability (A:N) are not directly affected because the vulnerability only allows reading files, not writing or modifying them. The affected versions are Apache Flink 1.11.0, 1.11.1, and 1.11.2, with the fix applied in versions 1.11.3 and 1.12.0.
Frequently Asked Questions
What is CVE-2020-17519?
CVE-2020-17519 is a high-severity directory traversal vulnerability in Apache Flink that allows an unauthenticated attacker to read arbitrary files from the JobManager's filesystem through the REST interface. It has a CVSS v3.1 score of 7.5 and has been actively exploited since its disclosure in January 2021.
Which Apache Flink versions are affected?
Only Apache Flink versions 1.11.0, 1.11.1, and 1.11.2 are affected. The vulnerability was introduced in 1.11.0 and fixed in 1.11.3 and 1.12.0. Earlier versions of Flink (1.10.x and below) are not affected by this specific vulnerability.
What data can an attacker access through CVE-2020-17519?
An attacker can read any file accessible to the Flink JobManager process, including Flink configuration files containing database credentials, cloud access keys, and connection strings. In big data environments, these credentials often provide access to sensitive data stores, data lakes, and messaging systems.
Why is a 2020 vulnerability still being actively exploited?
CVE-2020-17519 remains actively exploited because many Apache Flink deployments are not regularly updated, the exploit is trivial to execute with a simple HTTP request, and the rewards of extracting credentials from data processing infrastructure are high. Automated scanners continuously probe for exposed Flink interfaces.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.