CVE-2025-32896
BaseFortify
Publication date: 2025-06-19
Last updated on: 2025-07-08
Assigner: Apache Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| apache | seatunnel | From 2.3.1 (inc) to 2.3.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-32896 is a vulnerability in Apache SeaTunnel versions up to 2.3.10 where unauthorized users can exploit the RESTful API endpoint `/hazelcast/rest/maps/submit-job` (api-v1) to submit jobs with specially crafted parameters. By manipulating extra parameters in the MySQL URL during job submission, an attacker can perform Arbitrary File Read and Deserialization attacks. This means they can access sensitive files without authorization and potentially execute malicious code through deserialization. [1]
How can this vulnerability impact me? :
This vulnerability can allow unauthorized attackers to read arbitrary files on the server, potentially exposing sensitive information. Additionally, through deserialization attacks, attackers might execute malicious code on the affected system, leading to further compromise, data breaches, or disruption of services. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by monitoring network traffic or logs for unauthorized access attempts to the `/hazelcast/rest/maps/submit-job` RESTful API endpoint using API version 1. Specifically, look for job submissions with unusual or extra parameters in the MySQL URL that could indicate attempts to exploit Arbitrary File Read or Deserialization attacks. Commands such as `curl` can be used to test the endpoint manually, for example: `curl -X POST http://<server>/hazelcast/rest/maps/submit-job -d '{"mysql_url":"<malicious_params>"}'`. Additionally, network monitoring tools like Wireshark or intrusion detection systems can be configured to alert on suspicious POST requests to this endpoint. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Apache SeaTunnel to version 2.3.11 or later, which contains the fix for this vulnerability. Additionally, enable the RESTful API version 2 (`api-v2`) and configure HTTPS two-way authentication to secure the job submission process and prevent unauthorized access. These measures will protect against Arbitrary File Read and Deserialization attacks via the vulnerable API endpoint. [1, 2]