bash command injection in spark interpreter

Vulnerability

Apache Zeppelin versions 0.9.0 and prior contain a bash command injection vulnerability in the Spark interpreter settings. An attacker can inject arbitrary system commands by manipulating the interpreter configuration. [1][2]

Exploitation

The attacker needs network access to the Zeppelin server and the ability to modify Spark interpreter settings (e.g., via the notebook interface or API). No authentication is explicitly required if the server is exposed, but typically some user interaction may be needed. No public exploit code is disclosed in the available references. [1][2]

Impact

Successful exploitation allows an attacker to execute arbitrary system commands on the Zeppelin server, leading to full remote code execution with the privileges of the Zeppelin process. This can result in data disclosure, modification, or denial of service. [1][2]

Mitigation

Upgrade to Apache Zeppelin version 0.10.1 or later, which contains the fix. [4] No known workarounds are available. Users should also restrict network access to the Zeppelin interface. [4]