Apache StreamPark: FreeMarker SSTI RCE Vulnerability

Vulnerability

Description

CVE-2024-29178 is a server-side template injection (SSTI) vulnerability in Apache StreamPark, an open-source streaming application development framework. In versions prior to 2.1.4, an authenticated user can inject malicious FreeMarker templates, leading to remote code execution (RCE) on the server. The flaw is rooted in insufficient sanitization of user-supplied input that is processed by the FreeMarker templating engine [1][3].

Attack

Vector

To exploit this vulnerability, an attacker must first have valid credentials and successfully log into the StreamPark web interface. Once authenticated, the attacker can craft a malicious template payload that is processed by the underlying FreeMarker engine. This prerequisite of authentication reduces the attack surface but does not eliminate the risk, especially in environments with shared or low-privilege accounts [1][3].

Impact

Successful exploitation grants the attacker arbitrary remote code execution on the StreamPark server. This can lead to full compromise of the application, including data exfiltration, lateral movement within the infrastructure, and potential disruption of streaming data pipelines managed by the platform. The official severity rating is moderate due to the authentication requirement [1][3].

Mitigation

All users are advised to upgrade to Apache StreamPark version 2.1.4 or later, which contains the fix for this vulnerability. No workarounds have been published, and the vendor recommends immediate patching to prevent exploitation [1][2][3].