CVE-2024-29737 (GCVE-0-2024-29737)

Vulnerability from cvelistv5 – Published: 2024-07-17 08:21 – Updated: 2025-02-13 17:47
VLAI?
Title
Apache StreamPark (incubating): maven build params could trigger remote command execution
Summary
In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Mitigation: all users should upgrade to 2.1.4 Background info: Log in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the "Build Argument". Note that there is no verification and interception of the special character "`". As a result, you will find that this injection command will be successfully executed after executing the build. In the latest version, the special symbol ` is intercepted.
Severity ?
No CVSS data available.
CWE
  • CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
Impacted products
Vendor Product Version
Apache Software Foundation Apache StreamPark (incubating) Affected: 2.0.0 , < 2.1.4 (semver)
Create a notification for this product.
Credits
L0ne1y
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "streampark",
            "vendor": "apache",
            "versions": [
              {
                "lessThan": "2.1.4",
                "status": "affected",
                "version": "2.0.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-29737",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-18T15:08:55.540743Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-22T15:29:56.839Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:10:55.460Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/07/17/2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache StreamPark (incubating)",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.1.4",
              "status": "affected",
              "version": "2.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "L0ne1y"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In streampark, the project module integrates Maven\u0027s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\u003cbr\u003e\u003cdiv\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003cbr\u003e\u003cbr\u003e\u003c/div\u003eall users \u003cspan style=\"background-color: var(--wht);\"\u003eshould upgrade to 2.1.4\u003cbr\u003e\u003cbr\u003eBackground info:\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u003cbr\u003eLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \"Build Argument\". Note that there is no verification and interception of the special character \"`\". As a result, you will find that this injection command will be successfully executed after executing the build.\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cdiv\u003eIn the latest version, the special symbol ` is intercepted.\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cbr\u003e"
            }
          ],
          "value": "In streampark, the project module integrates Maven\u0027s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\n\nMitigation:\n\nall users should upgrade to 2.1.4\n\nBackground info:\n\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \"Build Argument\". Note that there is no verification and interception of the special character \"`\". As a result, you will find that this injection command will be successfully executed after executing the build.\n\nIn the latest version, the special symbol ` is intercepted."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "text": "low"
            },
            "type": "Textual description of severity"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-17T08:25:06.602Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/07/17/2"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Apache StreamPark (incubating): maven build params could trigger remote command execution",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2024-29737",
    "datePublished": "2024-07-17T08:21:12.035Z",
    "dateReserved": "2024-03-19T14:26:23.388Z",
    "dateUpdated": "2025-02-13T17:47:42.503Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2.0.0\", \"versionEndExcluding\": \"2.1.4\", \"matchCriteriaId\": \"EA1D77DB-B854-44DA-9749-A3F326BD4D06\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In streampark, the project module integrates Maven\u0027s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\\n\\nMitigation:\\n\\nall users should upgrade to 2.1.4\\n\\nBackground info:\\n\\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \\\"Build Argument\\\". Note that there is no verification and interception of the special character \\\"`\\\". As a result, you will find that this injection command will be successfully executed after executing the build.\\n\\nIn the latest version, the special symbol ` is intercepted.\\n\\n\"}, {\"lang\": \"es\", \"value\": \"En Streampark, el m\\u00f3dulo del proyecto integra las capacidades de compilaci\\u00f3n de Maven. La validaci\\u00f3n de los par\\u00e1metros de entrada no es estricta, lo que permite a los atacantes insertar comandos para la ejecuci\\u00f3n remota de comandos. El requisito previo para un ataque exitoso es que el usuario debe iniciar sesi\\u00f3n en el sistema Streampark y tener permisos a nivel de sistema. Generalmente, s\\u00f3lo los usuarios de ese sistema tienen autorizaci\\u00f3n para iniciar sesi\\u00f3n y los usuarios no ingresar\\u00edan manualmente un comando de operaci\\u00f3n peligroso. Por tanto, el nivel de riesgo de esta vulnerabilidad es muy bajo. Mitigaci\\u00f3n: todos los usuarios deben actualizar a 2.1.4 Informaci\\u00f3n general: inicie sesi\\u00f3n en Streampark utilizando el nombre de usuario predeterminado (por ejemplo, test1, test2, test3) y la contrase\\u00f1a predeterminada (streampark). Navegue hasta el m\\u00f3dulo Proyecto y luego agregue un nuevo proyecto. Ingrese la direcci\\u00f3n del repositorio git del proyecto e ingrese `touch /tmp/success_2.1.2` como \\\"Argumento de compilaci\\u00f3n\\\". Tenga en cuenta que no existe verificaci\\u00f3n ni interceptaci\\u00f3n del car\\u00e1cter especial \\\"`\\\". Como resultado, encontrar\\u00e1 que este comando de inyecci\\u00f3n se ejecutar\\u00e1 con \\u00e9xito despu\\u00e9s de ejecutar la compilaci\\u00f3n. En la \\u00faltima versi\\u00f3n, se intercepta el s\\u00edmbolo especial `.\"}]",
      "id": "CVE-2024-29737",
      "lastModified": "2024-11-21T09:08:12.270",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\", \"baseScore\": 4.7, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 3.4}, {\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-07-17T09:15:02.527",
      "references": "[{\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/17/2\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5\", \"source\": \"security@apache.org\", \"tags\": [\"Mailing List\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/17/2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}, {\"url\": \"https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\"]}]",
      "sourceIdentifier": "security@apache.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"security@apache.org\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-77\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-29737\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2024-07-17T09:15:02.527\",\"lastModified\":\"2025-02-13T18:17:50.797\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In streampark, the project module integrates Maven\u0027s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\\n\\nMitigation:\\n\\nall users should upgrade to 2.1.4\\n\\nBackground info:\\n\\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \\\"Build Argument\\\". Note that there is no verification and interception of the special character \\\"`\\\". As a result, you will find that this injection command will be successfully executed after executing the build.\\n\\nIn the latest version, the special symbol ` is intercepted.\"},{\"lang\":\"es\",\"value\":\"En Streampark, el m\u00f3dulo del proyecto integra las capacidades de compilaci\u00f3n de Maven. La validaci\u00f3n de los par\u00e1metros de entrada no es estricta, lo que permite a los atacantes insertar comandos para la ejecuci\u00f3n remota de comandos. El requisito previo para un ataque exitoso es que el usuario debe iniciar sesi\u00f3n en el sistema Streampark y tener permisos a nivel de sistema. Generalmente, s\u00f3lo los usuarios de ese sistema tienen autorizaci\u00f3n para iniciar sesi\u00f3n y los usuarios no ingresar\u00edan manualmente un comando de operaci\u00f3n peligroso. Por tanto, el nivel de riesgo de esta vulnerabilidad es muy bajo. Mitigaci\u00f3n: todos los usuarios deben actualizar a 2.1.4 Informaci\u00f3n general: inicie sesi\u00f3n en Streampark utilizando el nombre de usuario predeterminado (por ejemplo, test1, test2, test3) y la contrase\u00f1a predeterminada (streampark). Navegue hasta el m\u00f3dulo Proyecto y luego agregue un nuevo proyecto. Ingrese la direcci\u00f3n del repositorio git del proyecto e ingrese `touch /tmp/success_2.1.2` como \\\"Argumento de compilaci\u00f3n\\\". Tenga en cuenta que no existe verificaci\u00f3n ni interceptaci\u00f3n del car\u00e1cter especial \\\"`\\\". Como resultado, encontrar\u00e1 que este comando de inyecci\u00f3n se ejecutar\u00e1 con \u00e9xito despu\u00e9s de ejecutar la compilaci\u00f3n. En la \u00faltima versi\u00f3n, se intercepta el s\u00edmbolo especial `.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.2,\"impactScore\":3.4},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@apache.org\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-77\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.0.0\",\"versionEndExcluding\":\"2.1.4\",\"matchCriteriaId\":\"EA1D77DB-B854-44DA-9749-A3F326BD4D06\"}]}]}],\"references\":[{\"url\":\"http://www.openwall.com/lists/oss-security/2024/07/17/2\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2024/07/17/2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-29737\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-07-18T15:08:55.540743Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:apache:streampark:*:*:*:*:*:*:*:*\"], \"vendor\": \"apache\", \"product\": \"streampark\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.1.4\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-07-18T15:11:56.010Z\"}}], \"cna\": {\"title\": \"Apache StreamPark (incubating): maven build params could trigger remote command execution\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"L0ne1y\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"low\"}}}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache StreamPark (incubating)\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.0.0\", \"lessThan\": \"2.1.4\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5\", \"tags\": [\"vendor-advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2024/07/17/2\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.1.0-dev\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In streampark, the project module integrates Maven\u0027s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\\n\\nMitigation:\\n\\nall users should upgrade to 2.1.4\\n\\nBackground info:\\n\\nLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \\\"Build Argument\\\". Note that there is no verification and interception of the special character \\\"`\\\". As a result, you will find that this injection command will be successfully executed after executing the build.\\n\\nIn the latest version, the special symbol ` is intercepted.\\n\\n\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"In streampark, the project module integrates Maven\u0027s compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.\u003cbr\u003e\u003cdiv\u003e\u003cbr\u003e\u003cdiv\u003eMitigation:\u003cbr\u003e\u003cbr\u003e\u003c/div\u003eall users \u003cspan style=\\\"background-color: var(--wht);\\\"\u003eshould upgrade to 2.1.4\u003cbr\u003e\u003cbr\u003eBackground info:\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u003cbr\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u003cbr\u003eLog in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the \\\"Build Argument\\\". Note that there is no verification and interception of the special character \\\"`\\\". As a result, you will find that this injection command will be successfully executed after executing the build.\u003cbr\u003e\u003c/span\u003e\u003c/span\u003e\u003cbr\u003e\u003cdiv\u003eIn the latest version, the special symbol ` is intercepted.\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003cbr\u003e\u003c/div\u003e\u003c/div\u003e\u003cp\u003e\u003c/p\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-77\", \"description\": \"CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2024-07-17T08:21:12.035Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-29737\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-07-22T15:29:56.839Z\", \"dateReserved\": \"2024-03-19T14:26:23.388Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2024-07-17T08:21:12.035Z\", \"assignerShortName\": \"apache\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.