Apache SeaTunnel Arbitrary File Read and Deserialization Vulnerability

A vulnerability in Apache SeaTunnel versions 2.3.1 through 2.3.10 allows unauthorized users to perform arbitrary file read and deserialization attacks by submitting jobs through the RESTful API v1. The issue arises when extra parameters are added to the MySQL URL, enabling access to sensitive files and potentially leading to malicious code execution.

Impact

Exploitation of this vulnerability could result in unauthorized access to files on the server and the possibility of executing malicious code through deserialization.

Remediation

Users are advised to upgrade to Apache SeaTunnel version 2.3.11, and to enable the RESTful API v2 along with HTTPS two-way authentication, which addresses this vulnerability.