1、安装漏洞版本

 376  wget https://mirrors.aliyun.com/apache/flink/flink-1.17.2/flink-1.17.2-bin-scala_2.12.tgz
  377  # 解压
  378  tar -zxvf flink-1.17.2-bin-scala_2.12.tgz
  379  cd flink-1.17.2
  380  # 启动单机集群（默认配置，无认证，满足未授权Jar上传复现条件）
  381  ./bin/start-cluster.sh
  382  netstat -nultp
  383  ps -ef | grep flink
  384  ss -tlnp | grep 8081
  385  curl http://127.0.0.1:8081/jars

3、界面登陆任意上传

4、漏洞修复

允许远程

rest.bind-address: 0.0.0.0
web.bind-address: 0.0.0.0
rest.port: 8081
rest.upload.max-content-length: 10485760
security.rest.authentication.enabled: true
security.rest.authentication.type: basic
security.rest.authentication.username: flink-admin
security.rest.authentication.password: sha256:8d72f98a746921b8d5556f42d2a58744061691857303d208722561860f8d4473
web.submit.enable: false
web.file-archive.enabled: false
rest.access-log.enabled: true
rest.cors.enabled: false
serialization.allow-java-serialization: false
execution.classloader.resolve-order: parent-first
jobmanager.memory.process.size: 1600m
taskmanager.memory.process.size: 1728m
taskmanager.numberOfTaskSlots: 1

禁止远程访问webUI

rest.bind-address: 127.0.0.1
web.bind-address: 127.0.0.1
rest.port: 8081
rest.upload.max-content-length: 10485760
security.rest.authentication.enabled: true
security.rest.authentication.type: basic
security.rest.authentication.username: flink-admin
security.rest.authentication.password: sha256:8d72f98a746921b8d5556f42d2a58744061691857303d208722561860f8d4473
web.submit.enable: false
web.file-archive.enabled: false
rest.access-log.enabled: true
rest.cors.enabled: false
serialization.allow-java-serialization: false
execution.classloader.resolve-order: parent-first
jobmanager.memory.process.size: 1600m
taskmanager.memory.process.size: 1728m
taskmanager.numberOfTaskSlots: 1