CVE-2020-1960

Vulnerability

Overview

CVE-2020-1960 is a vulnerability in Apache Flink (versions 1.1.0 through 1.10.0) that affects the JMXReporter component. When a Flink process is running with an enabled JMXReporter and a specific port configured via metrics.reporter..port, an attacker with local access to the machine can exploit the JMX port. The vulnerability allows the attacker to perform a man-in-the-middle (MITM) attack by sending a specially crafted request to rebind the JMXRMI registry to an attacker-controlled registry [1].

Exploitation

The attack requires local access to the machine running Flink and access to the JMX port. No authentication is needed for the initial bind operation. The attacker can intercept and modify the communication between legitimate JMX clients and the Flink process, effectively hijacking the RMI registry [1].

Impact

Successful exploitation compromises any connection established to the Flink process via JMX. The attacker can extract credentials and any other data transferred over JMX, leading to potential credential theft and data exfiltration [1].

Mitigation

Apache has released patched versions (1.11.0 and later) that fix this vulnerability. Users are advised to upgrade to a non-affected version or disable the JMXReporter if not needed. No workaround is available for the vulnerable configuration [1].