CVE-2017-12619

Description

Apache Zeppelin prior to version 0.7.3 was vulnerable to session fixation [1][2]. The application did not regenerate the session identifier after a successful authentication, enabling an attacker to force a known session ID on a victim and subsequently hijack the authenticated session.

Exploitation

An attacker can craft a link containing a predetermined session ID and entice the victim to click it. If the victim authenticates using that session, the attacker can then use the same session ID to impersonate the victim, gaining unauthorized access to the Zeppelin instance [2].

Impact

Successful exploitation allows an attacker to access the victim's session and perform actions with the victim's privileges, including viewing or modifying notebooks, configurations, and other sensitive data [1].

Mitigation

The issue was fixed in Apache Zeppelin 0.7.3, released in September 2017 [3]. Users should upgrade to 0.7.3 or later to mitigate this vulnerability.