[ZEPPELIN-3725] Possible SQL injection

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 0.8.0
• Fix Version/s: 0.11.0
• Component/s: security
• Labels: beginners security
• Assignee: Unassigned
• Reporter: Habi Sajitha Ravi
• Created: 16/Aug/18 11:13
• Updated: 05/Feb/24 10:14
• Resolved: 01/Nov/23 15:24

Description

I was playing with Zeppelin. I found JdbcRealm implementation could result in SQL injection.  I am not sure about the exploitability. Since  an untrusted user need to modify the config.

 

vulnerable code 

userquery = String.format("SELECT %s FROM %s", username, tablename);

 

 

Issue Links

• links to: GitHub Pull Request #4676