CVE-2024-34457
📋 TL;DR
This vulnerability in Apache Flink allows authenticated regular users to bypass authorization controls and access sensitive user information they shouldn't have permission to view. After successful login, users can manually craft requests using their authorization token to view all users' Flink information including executeSQL and config data. This affects all Apache Flink deployments running versions before 2.1.4.
💻 Affected Systems
- Apache Flink
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker could access sensitive configuration data and SQL execution information from all users, potentially leading to data exposure, privilege escalation, or further system compromise.
Likely Case
Regular users accidentally or intentionally accessing other users' Flink information, exposing sensitive operational data and potentially violating data privacy regulations.
If Mitigated
With proper network segmentation and access controls, the impact is limited to authorized users within the same security zone, but sensitive data exposure still occurs.
🎯 Exploit Status
Exploitation requires valid user credentials and involves manually crafting HTTP requests with authorization tokens. No public exploit code has been identified in the provided references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.1.4
Vendor Advisory: https://lists.apache.org/thread/brlfrmvw9dcv38zoofmhxg7qookmwn7j
Restart Required: Yes
Instructions:
1. Download Apache Flink 2.1.4 from the official Apache website. 2. Stop all Flink services. 3. Backup your current configuration and data. 4. Replace the Flink installation with version 2.1.4. 5. Restore your configuration. 6. Restart all Flink services.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Flink management interfaces to only trusted administrative networks
Enhanced Monitoring
allImplement detailed logging and monitoring of user access to Flink APIs to detect unauthorized access attempts
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Flink management interfaces from regular user networks
- Deploy a web application firewall (WAF) with custom rules to detect and block unauthorized API requests to user information endpoints
🔍 How to Verify
Check if Vulnerable:
Check the Flink version by examining the installation directory or running 'flink --version' command. If version is below 2.1.4, the system is vulnerable.Check Version:
flink --versionVerify Fix Applied:
After upgrading, verify the version shows 2.1.4 or higher using 'flink --version'. Test that regular users can no longer access other users' Flink information through API requests.📡 Detection & Monitoring
Log Indicators:
- Multiple unauthorized API requests to user information endpoints from single user accounts
- Access patterns showing users accessing other users' Flink data
Network Indicators:
- Unusual API call patterns to /jobs/overview or similar endpoints from non-admin users
- Multiple GET requests to user-specific endpoints from single IPs
SIEM Query:
source="flink-logs" AND (uri_path="/jobs/*" OR uri_path="/config*") AND user_role="regular" AND count by user_id > threshold