[ZEPPELIN-5624] Arbitrary file deletion vulnerability

• Type: Bug
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 0.9.0, 0.10.0
• Fix Version/s: 0.11.0
• Component/s: security
• Labels: security vulnerability
• Assignee: Cherry Li
• Reporter: Cherry Li
• Created: 04/Jan/22 10:35
• Updated: 25/Mar/22 10:37
• Resolved: 25/Mar/22 10:37

Description

I found a vulnerability in the Apache zeppelin (Unauthorized Level Vulnerability) project.

By accessing

/api/interpreter/setting/..%2Flogs 

you can delete the logs folder in the directory where the current project is located, if it is changed to

 

/api/interpreter/setting/..%2F..%2Fzeppelin 

 

, then you can delete the entire zeppelin application directory, including all configuration files, zeppelin main program files, etc.

Issue Links

• is duplicated by: ZEPPELIN-5679 tidy up inlineRemove in InterpreterSettingManager