CVE-2024-29737— Apache StreamPark (incubating): maven build params could trigger remote command execution
Quick assessment
Affected
Apache Software Foundation Apache StreamPark (incubating)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache StreamPark是美国阿帕奇（Apache）基金会的一个流媒体应用程序开发框架。 Apache StreamPark 2.0.0至2.1.4之前版本存在命令注入漏洞，该漏洞源于输入参数验证不严格，攻击者可以插入命令进行远程命令执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-29737
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache StreamPark (incubating): maven build params could trigger remote command execution
Source: CVE Program / CVE List V5
Vulnerability Description
In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.
Mitigation:
all users should upgrade to 2.1.4
Background info:
Log in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the "Build Argument". Note that there is no verification and interception of the special character "`". As a result, you will find that this injection command will be successfully executed after executing the build.
In the latest version, the special symbol ` is intercepted.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在命令中使用的特殊元素转义处理不恰当(命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Apache StreamPark 命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache StreamPark是美国阿帕奇（Apache）基金会的一个流媒体应用程序开发框架。 Apache StreamPark 2.0.0至2.1.4之前版本存在命令注入漏洞，该漏洞源于输入参数验证不严格，攻击者可以插入命令进行远程命令执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache StreamPark (incubating) | 2.0.0 ~ 2.1.4 | - |
|
II. Public POCs for CVE-2024-29737
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-29737
请登录查看更多情报信息。
Mailing List Discussions for CVE-2024-29737 (2)
-
https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5 vendor-advisory
Same Patch Batch · Apache Software Foundation · 2024-07-17 · 8 CVEs total
| CVE-2024-39863 | Apache Airflow: Potential XSS Vulnerability | |
| CVE-2024-39877 | Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler | |
| CVE-2023-52291 | Apache StreamPark (incubating): Unchecked maven build params could trigger remote command | |
| CVE-2024-30471 | Apache StreamPipes: Potential creation of multiple identical accounts | |
| CVE-2024-31979 | Apache StreamPipes: Possibility of SSRF in pipeline element installation process | |
| CVE-2024-31411 | Apache StreamPipes: Potential remote code execution (RCE) via file upload | |
| CVE-2024-29120 | Apache StreamPark: Information leakage vulnerability |
IV. Related Vulnerabilities
Same product: Apache StreamPark (incubating)
-
CVE-2023-52291
Apache StreamPark (incubating): Unchecked maven build params -
CVE-2023-52290
Apache StreamPark (incubating): Unchecked SQL query fields t -
CVE-2023-30867
Apache StreamPark (incubating): Authenticated system users c -
CVE-2023-49898
Apache StreamPark (incubating): Authenticated system users c -
CVE-2022-46365
Apache StreamPark (incubating): Logic error causing any acco
Same vendor: Apache Software Foundation
-
CVE-2026-102795
Apache Traffic Server: SNI to Host header matching policy is -
CVE-2026-59265
Apache OpenOffice, Apache OpenOffice: Opening a malicious do -
CVE-2026-66054
Apache Thrift: C++ THeaderTransport does not enforce configu -
CVE-2026-61374
Apache Thrift: Java TSaslTransport post-auth data-frame miss -
CVE-2026-63772
Apache Thrift: Unauthenticated single-packet crash of Go Thr
Same weakness: CWE-77
-
CVE-2026-102133
Kiteworks Core Arbitrary File Write through Command Injectio -
CVE-2026-102794
Ziroom ZHOME A0101 ping command injection -
CVE-2026-102793
Ziroom ZHOME A0101 set_time_zone command injection -
CVE-2026-102792
Ziroom ZHOME A0101 set_syslog command injection -
CVE-2026-102827
simple-git: unsafe-operations plugin bypass via git long-opt
V. Comments for CVE-2024-29737
No comments yet