CVE-2024-29178: Apache StreamPark: FreeMarker SSTI RCE Vulnerability

July 18, 2024 (updated February 13, 2025)

On versions before 2.1.4, a user could log in and perform a template injection attack resulting in Remote Code Execution on the server, The attacker must successfully log into the system to launch an attack, so this is a moderate-impact vulnerability.

Mitigation:

all users should upgrade to 2.1.4

References

github.com/advisories/GHSA-vv8h-m63v-53pq
github.com/apache/streampark
lists.apache.org/thread/n6dhnl68knpxy80t35qxkkw2691l8sfn
nvd.nist.gov/vuln/detail/CVE-2024-29178

Code Behaviors & Features

Detect and mitigate CVE-2024-29178 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →