Apache StreamPark (incubating): maven build params could trigger remote command execution

In Apache StreamPark (incubating), the project module integrates Maven's compilation capabilities. The input parameter validation for build arguments is insufficient, allowing attackers to inject arbitrary commands. Specifically, the backtick character (`) is not filtered or escaped, enabling command injection during the Maven build process [1]. This vulnerability affects StreamPark versions 2.0.0 through 2.1.3 [3].

Exploitation requires the attacker to be logged into the StreamPark system with system-level permissions, typically meaning they are an authorized user of the platform. The attack is carried out by navigating to the Project module, adding a new project, and entering a malicious payload—such as touch /tmp/success_2.1.2—in the Build Argument field. The malicious command is then executed when the build runs [1]. The official description notes that users would not normally manually input dangerous commands, which lowers the exploitation risk [3].

Successful command injection allows the attacker to execute arbitrary operating system commands on the StreamPark server with the privileges of the StreamPark process. This could lead to data compromise, service disruption, or further lateral movement within the environment [1].

Mitigation: All users should upgrade to Apache StreamPark 2.1.4, which intercepts the special backtick symbol and prevents the injection [1][3]. No workarounds have been published for versions prior to this fix.