CVE-2020-17519 PoC — Apache Flink directory traversal attack: reading remote files through the REST API

Source

https://github.com/givemefivw/CVE-2020-17519

Associated Vulnerability

Title: Apache Flink directory traversal attack: reading remote files through the REST API (CVE-2020-17519)
Description:A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process. Access is restricted to files accessible by the JobManager process. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit b561010b0ee741543c3953306037f00d7a9f0801 from apache/flink:master.

Description

CVE-2020-17519 Cheetah

Readme

# CVE-2020-17519
CVE-2020-17519 Cheetah语言版，支持批量扫描。

将ip.txt复制到/script/漏洞探测/Apache/文件夹下，打开Wker主程序
![](./re.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →