CVE-2020-17518: 
Java vulnerability analysis and mitigation

CVE-2020-17518 affects Apache Flink versions 1.5.1 to 1.11.2. The vulnerability was introduced in Flink 1.5.1 when a REST handler was implemented that allows writing uploaded files to arbitrary locations on the local file system through maliciously modified HTTP headers (NVD, OSS Security).

The vulnerability is classified as a directory traversal attack (CWE-22) with a CVSS v3.1 base score of 7.5 (HIGH). The attack vector is network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) with no impact on confidentiality (C:N) but high impact on integrity (I:H) and no impact on availability (A:N) (NVD).

The vulnerability allows attackers to write files to any location accessible by the Flink process through the REST API. This could potentially lead to system compromise through arbitrary file writing on the affected system (OSS Security).

The vulnerability can be exploited remotely through the REST API by sending maliciously crafted HTTP headers. No special privileges or user interaction is required for exploitation (NVD).

Users should upgrade to Flink version 1.11.3 or 1.12.0 if their Flink instances are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 in the apache/flink master branch (OSS Security).

The vulnerability was discovered by 0rich1 of Ant Security FG Lab and was responsibly disclosed to the Apache Flink team. The Apache Software Foundation included this vulnerability in their 2020 Security Report (OSS Security).