Apache Flink Kubernetes Operator Server-Side Request Forgery and Local File Access Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Apache Flink Kubernetes Operator, affecting versions 1.3.0 prior to 1.15.0. The vulnerability arises because the FlinkSessionJob jarURI is not properly validated, allowing users with create permissions to read files from the operator pod's filesystem. Additionally, content can be pulled from any backing store accessible through Flink's pluggable filesystem layer and accessed via the submitted Flink job. The vulnerability also allows fetching from http or https addresses without any restrictions on the URI scheme, host, IP range, or protections against internal or link-local addresses.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files on the operator pod's filesystem and allow interception of data from external sources through Flink's filesystem layer, potentially including sensitive information.

Remediation

Users are advised to upgrade to Apache Flink Kubernetes Operator version 1.15.0 or later, which addresses this vulnerability.