[jira] [Commented] (FLINK-26209) Possibility of Command Injection attack

["Chesnay Schepler (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/FLINK-26209?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17494153#comment-17494153 ] 

Chesnay Schepler commented on FLINK-26209:
------------------------------------------

That would require write access to the configuration (i.e., the ability to configure Flink), in which case an attacker can do all sorts bad stuff anyway.

As a result this isn't really a vulnerability.

I appreciate your interest nonetheless. Do note though that if you stumble on other potential vulnerabilities to follow the reporting procedures outlined [here|https://flink.apache.org/security.html#i-found-a-vulnerability-in-flink-how-do-i-report-it].

> Possibility of Command Injection attack 
> ----------------------------------------
>
>                 Key: FLINK-26209
>                 URL: https://issues.apache.org/jira/browse/FLINK-26209
>             Project: Flink
>          Issue Type: Bug
>          Components: Library / Machine Learning
>            Reporter: Iman Sharafaldin
>            Priority: Major
>
> As you can see in line 134 command line is built using string concatenation. An attacker who has control over args can execute malicious commands.
>  
> |final String cmd = discoveryScript.getAbsolutePath() + " " + gpuAmount + " " + args;|
> ||
> [https://github.com/apache/flink/blob/0d29b23f892714e4936b8af2f896e3040ddc9e89/flink-external-resources/flink-external-resource-gpu/src/main/java/org/apache/flink/externalresource/gpu/GPUDriver.java#L134]
>  
>  
> Reference:
> https://owasp.org/www-community/attacks/Command_Injection



--
This message was sent by Atlassian Jira
(v8.20.1#820001)