CVE-2024-29178: Apache Streampark RCE Vulnerability

CVE-2024-29178 Overview

CVE-2024-29178 is a server-side template injection vulnerability in Apache StreamPark affecting versions before 2.1.4. An authenticated user can inject template expressions that the server evaluates, resulting in remote code execution on the host running StreamPark. The flaw is classified under CWE-94: Improper Control of Generation of Code. Because exploitation requires valid credentials, the vendor characterizes the impact as moderate, though the CVSS metrics reflect full compromise of confidentiality, integrity, and availability once access is obtained. The Apache StreamPark project released version 2.1.4 to address the issue.

Critical Impact
An authenticated attacker can achieve remote code execution on the StreamPark server through template injection, leading to full system compromise.

Affected Products

Apache StreamPark versions prior to 2.1.4
CPE: cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*
Fixed release: Apache StreamPark 2.1.4

Discovery Timeline

2024-07-18 - CVE-2024-29178 published to NVD
2024-07-18 - Apache disclosure posted to the OpenWall OSS Security list and the Apache mailing list thread
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29178

Vulnerability Analysis

Apache StreamPark is a stream processing application framework that provides a management console for Flink and Spark workloads. The vulnerability resides in a code path that renders user-supplied input through a server-side template engine without safe sandboxing. When an authenticated user submits crafted template syntax, the engine evaluates the expression on the server and yields arbitrary code execution in the StreamPark process context.

Because StreamPark orchestrates data pipeline jobs, the process typically holds credentials and network access to downstream systems such as Flink clusters, YARN resource managers, object storage, and databases. Successful exploitation therefore extends beyond the host to any resource the StreamPark service can reach.

Root Cause

The root cause is improper neutralization of user input passed to a template engine, tracked as [CWE-94]. Input intended as data is interpreted as code, allowing directives that invoke runtime methods, spawn processes, or read arbitrary files. The Apache StreamPark team addressed this by hardening the template handling logic in the 2.1.4 release.

Attack Vector

Exploitation requires network reach to the StreamPark web interface and valid low-privileged credentials. An attacker with a legitimate account submits a payload containing template directives through a vulnerable input field. The server parses and evaluates the payload, executing attacker-controlled logic under the StreamPark service account. From that foothold, adversaries can pivot into the data platform, exfiltrate job configurations and secrets, or deploy persistence.

No public proof-of-concept exploit is currently listed in Exploit-DB or the CISA Known Exploited Vulnerabilities catalog. Refer to the Apache advisory thread for authoritative technical detail.

Detection Methods for CVE-2024-29178

Indicators of Compromise

Unexpected child processes such as sh, bash, cmd.exe, or powershell.exe spawned by the StreamPark JVM process
Outbound network connections from the StreamPark host to unfamiliar IP addresses shortly after authenticated console activity
Web access logs containing template syntax such as ${...}, <#...>, or #{...} in POST bodies to StreamPark endpoints
New or modified files under StreamPark working directories that were not deployed through the normal job workflow

Detection Strategies

Inventory StreamPark installations and compare versions against 2.1.4 to identify vulnerable hosts
Alert on JVM processes launching operating system shells or scripting interpreters, which is atypical for the StreamPark runtime
Review authentication logs for accounts that submitted job or template modifications immediately before anomalous process activity
Correlate web application logs with endpoint telemetry to link authenticated sessions to post-exploitation behavior

Monitoring Recommendations

Forward StreamPark application logs, host process telemetry, and network flows to a centralized analytics platform for correlation
Baseline normal process trees for the StreamPark service and alert on deviations
Monitor for privilege changes, new cron entries, or SSH key additions on hosts running StreamPark
Track outbound egress from data platform hosts to detect command-and-control or exfiltration channels

How to Mitigate CVE-2024-29178

Immediate Actions Required

Upgrade all Apache StreamPark deployments to version 2.1.4 or later without delay
Rotate credentials, API tokens, and service account keys that were reachable from the StreamPark host
Audit StreamPark user accounts and disable any that are inactive, shared, or no longer required
Restrict network access to the StreamPark console to trusted management networks only

Patch Information

Apache StreamPark 2.1.4 contains the official fix. Consult the Apache mailing list announcement and the OpenWall OSS Security notice for release details. Apply the upgrade in a staged manner, validate job configurations after upgrade, and confirm that the console version reports 2.1.4 or higher.

Workarounds

If immediate upgrade is not possible, place the StreamPark console behind an authenticated reverse proxy that restricts access by source IP
Enforce strong, unique passwords and multi-factor authentication for all StreamPark accounts to raise the barrier to authenticated exploitation
Reduce the privileges of the operating system account running the StreamPark JVM to limit blast radius if code execution occurs
Continuously monitor the StreamPark host for anomalous child processes until the patched version is deployed

bash

# Verify installed Apache StreamPark version and upgrade
cat $STREAMPARK_HOME/RELEASE 2>/dev/null || ls $STREAMPARK_HOME

# After downloading 2.1.4 from the Apache StreamPark project:
# 1. Stop the current service
$STREAMPARK_HOME/bin/streampark.sh stop

# 2. Back up configuration and data
tar -czf streampark-backup-$(date +%F).tar.gz $STREAMPARK_HOME/conf $STREAMPARK_HOME/data

# 3. Deploy version 2.1.4 and restart
$STREAMPARK_HOME_NEW/bin/streampark.sh start