Uploaded image for project: 'Mesos'
  1. Mesos
  2. MESOS-5388

MesosContainerizerLaunch flags execute arbitrary commands via shell.

    XMLWordPrintableJSON

    Details

    • Sprint:
      Mesosphere Sprint 39, Mesosphere Sprint 40
    • Story Points:
      5

      Description

      For example, the docker volume isolator's containerPath is appended (without sanitation) to a command that's executed in this manner. As such, it's possible to inject arbitrary shell commands to be executed by mesos.

      https://github.com/apache/mesos/blob/17260204c833c643adf3d8f36ad8a1a606ece809/src/slave/containerizer/mesos/launch.cpp#L206

      Perhaps instead of strings these commands could/should be sent as string arrays that could be passed as argv arguments w/o shell interpretation?

        Attachments

          Activity

            People

            • Assignee:
              gilbert Gilbert Song
              Reporter:
              jdef James DeFelice
              Shepherd:
              Jie Yu
            • Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: