Jiahua Huang

A security issue in Apache SeaTunnel allows attackers to read files on the MySQL server by modifying the information in the MySQL URL. The issue can be exploited by setting specific parameters in the MySQL URL, such as `allowLoadLocalInfile=true`, `allowUrlInLocalInfile=true`, `allowLoadLocalInfileInPath=/`, and `maxAllowedPacket=655360`. This allows for arbitrary file read vulnerability.

The issue is related to a Web Authentication vulnerability in Apache SeaTunnel, where the jwt key is hardcoded in the application. This allows an attacker to forge any token and log in as any user. The attacker can obtain the secret key from `/seatunnel-server/seatunnel-app/src/main/resources/application.yml` and then create a token.