Apache StreamPark CVE-2025-54981

Exploitation requires that the attacker can obtain the sensitive data encrypted by StreamPark - specifically JWT tokens and other authentication data protected using AES in ECB mode with a weak random number generator - in any StreamPark deployment from 2.0.0 up to (but not including) 2.1.7. The core prerequisite is access to the encrypted artifacts (e.g., intercepted or exfiltrated token ciphertext); the weakness then enables recovery or prediction of plaintext/tokens due to ECB's deterministic block mapping and insufficient RNG entropy. Limiting factors: there is no observed active exploitation, no public exploit, and practical attacks hinge on first acquiring the ciphertext and performing cryptographic effort, so the vendor's AC:L/PR:N rating overstates ease. Upgrading to 2.1.7 remediates the condition entirely.

Signals are mixed and lean toward lower real-world urgency than the 7.5 (HIGH) base score alone suggests. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) frames this as a remote, unauthenticated, low-complexity confidentiality breach, but that framing is generous for a cryptographic weakness: exploiting AES-ECB and a weak RNG realistically requires an attacker to first obtain the encrypted artifacts (e.g., stored or transmitted JWT ciphertext) and then perform cryptanalysis or token prediction, which is not the trivial AC:L the vector implies. EPSS is low at 0.24% (14th percentile), and there is no CISA KEV listing and no public exploit identified - consistent with no public exploit identified at time of analysis. There is no evidence of active exploitation; the issue is a vendor-discovered design weakness (reported by security@apache.org) rather than an observed attack. Net: this is a legitimate cryptographic hygiene defect worth patching, but it is a 'high-CVSS, lower-real-risk' case rather than an emergency - prioritize it on a normal patch cadence unless the deployment exposes encrypted JWTs to untrusted parties. Note the conflict: CVSS AC:L versus the cryptanalysis effort actually needed - treat AC:L as optimistic.

An attacker who can capture or access StreamPark-issued JWT tokens or other sensitive data encrypted with AES in ECB mode exploits the deterministic ECB structure and the predictable weak random number generator to recover or forge authentication material, then reuses it to impersonate a legitimate user. No public exploit code is known, and success depends on the attacker first gaining access to the ciphertext, so this is opportunistic rather than point-and-click.