Help to reproduce

[gbossert]

First of all thank you for your work.

I would like to reproduce your findings in order to analyze network footprints of the exploitation (eventhough your code is crystal clear and could be enough).
Unfortunately I cannot manage to reproduce this vulnerability.

Please find below my recipe:
First shell:

docker run --rm --name=jobmanager --publish 8081:8081 --env FLINK_PROPERTIES="jobmanager.rpc.address: jobmanager" flink:1.11 jobmanager

Second shell:

> $ touch urls.txt && echo "http://127.0.0.1:8081" > urls.txt && python3 cve.py urls.txt                                                                                                                          

  _______      ________    ___   ___ ___   ___        __ ______ _____ __  ___  
 / ____\ \    / /  ____|  |__ \ / _ \__ \ / _ \      /_ |____  | ____/_ |/ _ \ 
| |     \ \  / /| |__ ______ ) | | | | ) | | | |______| |   / /| |__  | | (_) |
| |      \ \/ / |  __|______/ /| | | |/ /| | | |______| |  / / |___ \ | |\__, |
| |____   \  /  | |____    / /_| |_| / /_| |_| |      | | / /   ___) || |  / / 
 \_____|   \/   |______|  |____|\___/____|\___/       |_|/_/   |____/ |_| /_/                                                                                                                                                 

[-]http://127.0.0.1:8081 None
Check Over

Of course I tried we a manually deployed fake file in /opt/flink/log/flag.test which works (as intended by Flink developers) but I cannot fetch the content of /opt/flink/flag.test with what I believe to be a proper path.

Any suggestions ?

[gbossert]

The Vulhub database provided the solution: https://github.com/vulhub/vulhub/tree/c339f4ddd977ff9a956350de4b1e6fb20b7b4415/flink/CVE-2020-17519