CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog

CVE-2020-17519 is an improper access control flaw (CWE-552) in Apache Flink, introduced in version 1.11.0 and carried into 1.11.1 and 1.11.2, that allows unauthenticated attackers to read arbitrary files on the JobManager host. It is triggered over the network by sending crafted directory-traversal requests to the REST interface of the JobManager process, requiring no credentials or user interaction (CVSS 3.1: 7.5, AV:N/PR:N/UI:N). An attacker gains read access to any file on the local filesystem that the JobManager process can access, potentially exposing configuration files, secrets, and credentials. Any deployment running Flink 1.11.0 through 1.11.2 with the JobManager REST interface reachable by untrusted clients is affected. Exploitation is active: a public proof-of-concept exists, EPSS estimates a 97.9% probability of exploitation within 30 days (100th percentile), and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2024-05-23.

Do: Upgrade Flink to 1.11.3 or 1.12.0 (or later) per the vendor's guidance, prioritizing instances whose REST interface is reachable from untrusted networks, as required by the CISA KEV entry. If upgrading is not immediately possible, restrict access to the JobManager REST port with firewall or network ACL rules. Review JobManager access logs for traversal-style REST requests indicating prior file-read exploitation.