CVE-2024-4701

CVE-2024-4701 is a vulnerability found in Genie, Netflix's open-source job orchestration engine for big data processing. This flaw is a path traversal issue that can lead to remote code execution. It exists in Genie's API, which handles file uploads and accepts a user-supplied filename as part of a multipart/form-data request. The vulnerability allows attackers to manipulate the filename parameter, enabling them to write files outside the intended storage path. This can lead to writing arbitrary content to locations where the Java process has write permissions, potentially compromising the entire system. The issue affects all Genie OSS versions prior to 4.3.18.