CVE-2024-29737: Apache Streampark RCE Vulnerability

CVE-2024-29737 Overview

CVE-2024-29737 is a command injection vulnerability in Apache StreamPark's project module, which integrates Maven compilation capabilities. The flaw stems from insufficient input parameter validation in the Build Argument field, allowing authenticated users with system-level permissions to inject shell metacharacters. An attacker who is already logged in can supply commands wrapped in backticks to the build process, which are then executed on the underlying host during project compilation. Apache classifies the risk as low because exploitation requires authenticated access with elevated privileges. The issue is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Authenticated attackers with system-level permissions can execute arbitrary operating system commands on the StreamPark host by injecting backtick-delimited payloads into project build arguments.

Affected Products

Apache StreamPark versions prior to 2.1.4
Apache StreamPark project module (Maven compilation integration)
Deployments exposing the StreamPark web console to authenticated users

Discovery Timeline

2024-07-17 - CVE-2024-29737 published to NVD
2024-07-17 - Public disclosure via the Openwall OSS-Security mailing list
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-29737

Vulnerability Analysis

Apache StreamPark exposes a Project module that lets authenticated users register a Git repository and trigger a Maven-based build. The build workflow accepts a user-supplied Build Argument string and passes it into the shell command constructed for the compilation step. StreamPark does not sanitize shell metacharacters such as the backtick character before assembling this command. As a result, any content enclosed in backticks is evaluated by the shell prior to Maven execution. An operator can therefore trigger arbitrary command execution under the identity of the StreamPark service account. The vendor confirmed the behavior by demonstrating that touch /tmp/success_2.1.2 inserted into the Build Argument field creates the file on the host during a build.

Root Cause

The root cause is improper neutralization of special elements used in a command [CWE-77]. StreamPark concatenates the Build Argument directly into the shell invocation that launches Maven. Backticks, $(), and similar constructs remain untouched, so the shell performs command substitution before running the intended build. The 2.1.4 release adds interception of the backtick character to block this injection vector.

Attack Vector

Exploitation is network-based but requires prior authentication with system-level permissions in StreamPark. An attacker logs in using valid credentials, navigates to the Project module, and creates or edits a project pointing at any reachable Git repository. In the Build Argument field, the attacker embeds a payload wrapped in backticks. Executing the build triggers command substitution, running the injected commands on the StreamPark host with the privileges of the StreamPark process. This provides a foothold for lateral movement, credential theft, or tampering with pipeline artifacts.

No verified public proof-of-concept code is published beyond the vendor's own reproduction steps. See the Apache Security Discussion Thread and the Openwall OSS-Security Mailing List for the original advisory.

Detection Methods for CVE-2024-29737

Indicators of Compromise

Project build history entries containing backtick characters, $(, ;, &&, or | inside the Build Argument field.
Child processes of the StreamPark or Maven build worker that are not mvn, java, or expected build tooling.
Unexpected files written to writable paths such as /tmp on the StreamPark host shortly after a build event.
Outbound network connections from the StreamPark host to unfamiliar destinations initiated during a build window.

Detection Strategies

Audit StreamPark project configurations and build logs for Build Argument values containing shell metacharacters.
Monitor process ancestry on StreamPark hosts and alert when the build worker spawns shells, interpreters, or reconnaissance utilities.
Correlate StreamPark authentication events for high-privilege accounts with project creation or modification actions in a short time window.

Monitoring Recommendations

Forward StreamPark application logs and host process telemetry to a centralized analytics platform for retention and search.
Baseline expected Maven build behavior and alert on deviations such as new outbound connections or writes outside the build workspace.
Track administrative account usage in StreamPark and require review of any changes to project build configurations.

How to Mitigate CVE-2024-29737

Immediate Actions Required

Upgrade all Apache StreamPark instances to version 2.1.4 or later, which intercepts the backtick character in Build Arguments.
Rotate credentials for any StreamPark accounts with system-level permissions, especially default accounts such as test1, test2, and test3.
Review existing project definitions and remove any Build Argument entries containing shell metacharacters.
Restrict network exposure of the StreamPark console to trusted administrative networks only.

Patch Information

Apache resolved CVE-2024-29737 in Apache StreamPark 2.1.4 by intercepting the backtick special character before it reaches the shell invocation. Administrators should follow the upgrade path documented in the Apache Security Discussion Thread and validate that the deployed version reports 2.1.4 or newer after upgrade.

Workarounds

Change all default StreamPark passwords, including the documented default streampark password, and disable unused accounts.
Limit system-level role assignments to a minimal set of trusted operators.
Place the StreamPark web interface behind an authenticated reverse proxy or VPN to reduce the exposed attack surface until patching completes.
Run the StreamPark service under a least-privilege operating system account with restricted filesystem and network capabilities.