CVE-2024-29070

After successful login, the Apache Streampark backend returns an 'Authorization' token that serves as authentication credentials in communication with the frontend. The vulnerability lies in the fact that after user logout, the server does not invalidate the issued token (lack of proper session lifecycle management, CWE-613). This means that anyone who has intercepted or copied the token can still send authenticated requests to the backend and access protected resources, even though the account owner has formally logged out.

An attacker with a valid token can gain unauthorized access to sensitive data (high confidentiality) and potentially cause resource unavailability (high availability), without requiring any privileges or user interaction.

Apache Streampark should be updated immediately to version 2.1.4 or later, in which the session is properly invalidated after logout. According to the vendor's recommendation, all users should perform this update.

Apache Streampark in all versions before 2.1.4