Apache

A significant security vulnerability (CVE-2025-32896) was disclosed in Apache SeaTunnel, a widely used distributed data integration platform. This flaw allows unauthorized users to execute arbitrary file read operations and deserialization attacks, potentially leading to remote code execution (RCE). The vulnerability affects versions 2.3.1 through 2.3.10 and was reported on April 12, 2025. The flaw stems from insufficient access controls in the RESTful API-v1 implementation, specifically targeting the /hazelcast/rest/maps/submit-job endpoint. This vulnerability is particularly dangerous as it can allow attackers to gain control over the affected SeaTunnel instance.

Source: https://cybersecuritynews.com/apache-seatunnel-vulnerability/

TPRM report: https://scoringcyber.rankiteo.com/company/the-apache-software-foundation

"id": "the302062025",
"linkid": "the-apache-software-foundation",
"type": "Vulnerability",
"date": "6/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'industry': 'Technology',
                        'name': 'Apache SeaTunnel',
                        'type': 'Software Platform'}],
 'attack_vector': 'Insufficient access controls in the RESTful API-v1 '
                  'implementation, specifically the '
                  '/hazelcast/rest/maps/submit-job endpoint.',
 'date_detected': '2025-04-12',
 'date_publicly_disclosed': '2025-04-12',
 'description': 'A significant security vulnerability in Apache SeaTunnel '
                'enables unauthorized users to execute arbitrary file read '
                'operations and deserialization attacks through its RESTful '
                'API interface.',
 'initial_access_broker': {'entry_point': '/hazelcast/rest/maps/submit-job '
                                          'endpoint'},
 'lessons_learned': 'Implement comprehensive security improvements, including '
                    'enhanced authentication mechanisms and input validation '
                    'procedures.',
 'motivation': 'Unauthorized access to sensitive system resources and remote '
               'code execution.',
 'post_incident_analysis': {'corrective_actions': 'Upgrade to version 2.3.11, '
                                                  'enable RESTful API-v2, '
                                                  'implement HTTPS two-way '
                                                  'authentication',
                            'root_causes': 'Insufficient access controls in '
                                           'the RESTful API-v1 implementation'},
 'recommendations': 'Upgrade to the latest release, enable RESTful API-v2, '
                    'implement HTTPS two-way authentication.',
 'response': {'containment_measures': 'Upgrade to version 2.3.11, enable '
                                      'RESTful API-v2, implement HTTPS two-way '
                                      'authentication',
              'remediation_measures': 'Upgrade to version 2.3.11, enable '
                                      'RESTful API-v2, implement HTTPS two-way '
                                      'authentication'},
 'title': 'Apache SeaTunnel RESTful API Vulnerability',
 'type': 'Remote Code Execution (RCE)',
 'vulnerability_exploited': 'CVE-2025-32896'}