CVE-2020-17518: Apache Flink Path Traversal Vulnerability

CVE-2020-17518 Overview

CVE-2020-17518 is a Path Traversal vulnerability affecting Apache Flink versions 1.5.1 and later. The vulnerability exists in a REST handler introduced in Apache Flink 1.5.1 that allows an attacker to write an uploaded file to an arbitrary location on the local file system by manipulating HTTP headers. This flaw enables unauthenticated remote attackers to write malicious files to any location accessible by the Flink process, potentially leading to remote code execution or complete system compromise.

Critical Impact

This vulnerability allows unauthenticated attackers to write arbitrary files to any location accessible by the Flink process, potentially enabling remote code execution and full system compromise on exposed Flink instances.

Affected Products

• Apache Flink versions 1.5.1 through 1.11.2
• Apache Flink versions 1.12.x prior to 1.12.0
• Any Apache Flink deployment with externally exposed REST API endpoints

Discovery Timeline

• 2021-01-05 - CVE CVE-2020-17518 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-17518

Vulnerability Analysis

The vulnerability resides in a REST handler component introduced in Apache Flink 1.5.1. This handler processes file upload requests but fails to properly validate and sanitize the destination file path provided in HTTP headers. The lack of input validation allows attackers to use path traversal sequences (such as ../) within the HTTP header to escape the intended upload directory and write files to arbitrary locations on the file system.

The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-23 (Relative Path Traversal). These weaknesses indicate that the application does not properly neutralize special elements within the pathname, allowing attackers to traverse outside the restricted directory structure.

Due to the network-accessible nature of the REST API, combined with the lack of authentication requirements and low attack complexity, this vulnerability poses a significant risk to any Flink deployment that exposes its REST endpoints to untrusted networks.

Root Cause

The root cause of this vulnerability is improper input validation in the REST handler's file upload functionality. The handler accepts a user-controlled file path via HTTP headers but fails to sanitize or validate this input against directory traversal attempts. The absence of canonicalization checks or path restriction enforcement allows maliciously crafted paths containing traversal sequences to escape the intended directory boundary.

Attack Vector

The attack is conducted over the network by sending specially crafted HTTP requests to the vulnerable Flink REST API endpoint. An attacker constructs an HTTP request with a maliciously modified header containing path traversal sequences that specify an arbitrary destination path for the uploaded file. Since the REST handler does not require authentication by default and the attack complexity is low, any attacker with network access to the Flink REST API can exploit this vulnerability.

The attack flow involves the attacker crafting an HTTP file upload request to the Flink REST endpoint, modifying the file destination header to include directory traversal sequences pointing to a sensitive location (such as /etc/cron.d/ for scheduled task execution or web server directories for webshell deployment), and then uploading a malicious payload. The Flink process writes the file to the attacker-specified location with its process privileges.

Detection Methods for CVE-2020-17518

Indicators of Compromise

• Unexpected files appearing in sensitive directories such as /etc/cron.d/, /var/www/, or application configuration directories
• HTTP access logs showing file upload requests to the Flink REST API with unusual path patterns containing ../ or encoded traversal sequences
• Files owned by the Flink process user appearing outside the standard Flink working directories
• Suspicious cron jobs, startup scripts, or webshells that were not intentionally created

Detection Strategies

• Monitor HTTP request logs for the Flink REST API, specifically looking for path traversal patterns in headers including ../, ..%2f, %2e%2e/, and similar encoded variations
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file creation or modification
• Deploy network intrusion detection rules to identify HTTP requests containing path traversal sequences targeting Flink endpoints
• Review Flink process file write operations using auditd or similar system auditing tools to track file creation outside expected directories

Monitoring Recommendations

• Enable detailed access logging on Flink REST API endpoints and forward logs to a centralized SIEM for analysis
• Configure alerting for any file creation by the Flink process user in sensitive system directories
• Implement network segmentation monitoring to detect unauthorized access attempts to internal Flink REST endpoints
• Regularly audit file system changes in directories writable by the Flink process to identify potential exploitation artifacts

How to Mitigate CVE-2020-17518

Immediate Actions Required

• Upgrade Apache Flink to version 1.11.3 or 1.12.0 or later immediately if your Flink instances are exposed to untrusted networks
• Restrict network access to Flink REST API endpoints using firewall rules or network segmentation to allow only trusted sources
• Review file system permissions and ensure the Flink process runs with minimal required privileges
• Audit systems for signs of exploitation including unexpected files in sensitive directories or suspicious scheduled tasks

Patch Information

Apache has addressed this vulnerability in Apache Flink versions 1.11.3 and 1.12.0. The fix was implemented in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 on the apache/flink master branch. All users running affected versions should upgrade to Flink 1.11.3 or 1.12.0 as soon as possible. The fix adds proper path validation and sanitization to prevent directory traversal in the file upload REST handler.

For additional information, refer to the Apache Flink Security Advisory and the Openwall Security Mailing List disclosure.

Workarounds

• If immediate patching is not possible, restrict network access to the Flink REST API to only trusted internal networks using firewall rules
• Deploy a reverse proxy or web application firewall (WAF) in front of the Flink REST API configured to block requests containing path traversal patterns
• Run the Flink process under a dedicated user account with restricted file system permissions to limit the impact of arbitrary file writes
• Consider disabling the REST API entirely if it is not required for your deployment until patching can be completed

# Example: Restrict Flink REST API access using iptables
# Allow only internal network access to Flink REST port (default 8081)
iptables -A INPUT -p tcp --dport 8081 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -s 172.16.0.0/12 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 8081 -j DROP