CVE-2024-29737

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low. Mitigation: all users should upgrade to 2.1.4 Background info: Log in to Streampark using the default username (e.g. test1, test2, test3) and the default password (streampark). Navigate to the Project module, then add a new project. Enter the git repository address of the project and input `touch /tmp/success_2.1.2` as the "Build Argument". Note that there is no verification and interception of the special character "`". As a result, you will find that this injection command will be successfully executed after executing the build. In the latest version, the special symbol ` is intercepted.

• CWE-77

• http://www.openwall.com/lists/oss-security/2024/07/17/2Mailing List
• https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5Mailing List
• http://www.openwall.com/lists/oss-security/2024/07/17/2Mailing List
• https://lists.apache.org/thread/xhx7jt1t24s6d7o435wxng8t0ojfbfh5Mailing List

Published

Jul 17, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-29731SQL injection vulnerabilities in SportsNET affecting version…9.8
• CVE-2024-29732A SQL Injection has been found on SCAN_VISIO eDocument Suite…9.8
• CVE-2024-29733Improper Certificate Validation vulnerability in Apache Airf…2.7
• CVE-2024-29734Uncontrolled search path element issue exists in SonicDICOM …7.8
• CVE-2024-29735Improper Preservation of Permissions vulnerability in Apache…5.3
• CVE-2024-29736A SSRF vulnerability in WADL service description in versions…9.1
• CVE-2024-29738In gov_init, there is a possible out of bounds read due to a…5.5
• CVE-2024-29739In tmu_get_temp_lut of tmu.c, there is a possible out of bou…5.5
• CVE-2024-2974The Essential Addons for Elementor – Best Elementor Template…5.3
• CVE-2024-29740In tmu_set_table of tmu.c, there is a possible out of bounds…7.4
• CVE-2024-29741In pblS2mpuResume of s2mpu.c, there is a possible mitigation…7.8
• CVE-2024-29742In apply_minlock_constraint of dvfs.c, there is a possible o…5.5