CVE-2020-17519

What is Apache Flink?

Apache Flink is a distributed stream-processing framework used to run real-time data pipelines and analytics at scale — the kind of infrastructure that sits behind fraud detection, real-time recommendation engines, and large-scale event processing. Its JobManager component exposes a REST API for submitting jobs, checking status, and managing the cluster, which in many deployments is reachable across the internal network or, in poorly segmented environments, from the internet.

Overview

CVE-2020-17519 is an improper access control vulnerability (CWE-552, files or directories accessible to external parties) that allows a remote, unauthenticated attacker to read arbitrary files on the local filesystem of the Flink JobManager through its REST interface (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5 High). A regression introduced in Flink 1.11.0 broke a path-sanitization check that had previously prevented directory traversal in a JobManager file-serving endpoint.

Affected Versions

Technical Details

The vulnerability was introduced as a regression during a refactor of Flink's JobManager web endpoint code in the 1.11.0 release — a path traversal check that had previously blocked ../-style directory-escape sequences in file-serving requests was inadvertently removed. An attacker can exploit this to read any file the JobManager process has permission to access, including configuration files that may contain credentials for downstream systems Flink connects to.

Discovery

Reported to the Apache Flink project through its standard security disclosure process, with the fix released in Flink 1.11.3 and folded into the 1.12.0 release.

Exploitation Context

CISA added this CVE to KEV in May 2024 — more than three years after the original fix — indicating exploitation of long-unpatched Flink deployments was still occurring years later, a pattern common for open-source big-data infrastructure that, once deployed and working, is often left unpatched far longer than internet-facing consumer software.

Remediation

1. Upgrade to Flink 1.11.3, 1.12.0, or later immediately if running an affected 1.11.x release.
2. Restrict access to the JobManager REST API to trusted internal networks only; it should never be directly reachable from the internet.
3. Audit JobManager configuration files for embedded credentials and rotate any that may have been exposed if the instance was ever internet-facing and unpatched.
4. Review Flink cluster logs for anomalous REST API file-access requests, particularly ones containing path traversal sequences, on any deployment that ran an affected version for an extended period.