Apache StreamPark: Authenticated users can trigger remote command execution

Vulnerability

Overview

CVE-2025-30001 is an Incorrect Execution-Assigned Permissions vulnerability in Apache StreamPark, affecting versions from 2.1.4 before 2.1.6 [1][3]. The issue stems from improper permission checks during job execution, where the system fails to correctly enforce the intended access controls for authenticated users [1].

Exploitation

An attacker must first authenticate to the StreamPark platform [3]. Once authenticated, they can exploit the vulnerability can be exploited to trigger remote command execution, likely by submitting or modifying a streaming job with malicious parameters that bypass the intended permission boundaries [3]. The attack vector is network-based and requires no special privileges beyond a valid user account [3].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary commands on the StreamPark server, potentially leading to full compromise of the application and underlying host [3]. This could result in data exfiltration, service disruption, or lateral movement within the network.

Mitigation

The vulnerability is fixed in Apache StreamPark version 2.1.6 [1][3]. Users running versions 2.1.4 or 2.1.5 should upgrade immediately. No workarounds have been publicly documented [1][3].