Apache StreamPark: FreeMarker SSTI RCE Vulnerability

The primary impact of CVE-2024-29178 is the potential for remote code execution. An attacker who can successfully log into the Apache StreamPark system can leverage template injection to execute arbitrary commands on the server. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The attacker could also establish a persistent foothold within the environment, enabling further malicious activities. While login is required, the potential for significant damage makes this a serious vulnerability, particularly in environments where user authentication is not adequately secured.

Organizations using Apache StreamPark in production environments, particularly those with less stringent authentication controls or legacy configurations, are at risk. Shared hosting environments where multiple users share the same StreamPark instance are also particularly vulnerable, as a compromised user account could be leveraged to exploit the vulnerability.

• java / server:

ps aux | grep -i streampark

• java / server:

find / -name "streampark.jar" 2>/dev/null

• java / server:

journalctl -u streampark -f | grep -i "template injection"

1. 2024-07-18Disclosure

   disclosure

1. Reserviert2024-03-18
2. Veröffentlicht2024-07-18
3. Geändert2025-02-13
4. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-29178 is to immediately upgrade Apache StreamPark to version 2.1.4 or later. This version contains the necessary fixes to prevent template injection vulnerabilities. If upgrading is not immediately feasible, consider implementing stricter input validation and sanitization on user-supplied data to reduce the attack surface. While not a complete solution, this can provide a temporary layer of defense. After upgrading, verify the fix by attempting to inject a simple template payload through the login form and confirming that it is properly sanitized and does not result in code execution.