Uploaded image for project: 'Hadoop YARN'
  1. Hadoop YARN
  2. YARN-10336

RM page should throw exception when command injected in RM REST API to get applications

VotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Fixed
    • 3.4.0, 3.3.1
    • 3.4.0, 3.3.1
    • webapp
    • None
    • Reviewed

    Description

      Using a web application attacking, we see that injecting commands like ACCEPTED, FAILED and FINISHED to RM REST API does not throw an exception. Refer images.

      Attachments

        1. YARN-10336.003.patch
          5 kB
          Bilwa S T
        2. YARN-10336.002.patch
          4 kB
          Bilwa S T
        3. testproof.png
          130 kB
          Bilwa S T
        4. YARN-10336.001.patch
          1 kB
          Bilwa S T
        5. RM_UI.jpg
          86 kB
          Rajshree Mishra
        6. CommandInject.jpg
          48 kB
          Rajshree Mishra

        Activity
          This comment will be Viewable by All Users Viewable by All Users
          Cancel

          People

            BilwaST Bilwa S T
            Rajshree Rajshree Mishra
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Slack

                Issue deployment