Notebook permissions bypass

Vulnerability

Apache Zeppelin versions 0.9.0 and prior contain an authentication bypass vulnerability (CVE-2020-13929) that allows an attacker to circumvent the Zeppelin authentication mechanism and impersonate any other user. The vulnerability is present in the notebook authentication logic, which fails to properly validate user identities under certain conditions, enabling unauthorized access to protected resources [1][2].

Exploitation

An attacker can exploit this vulnerability by sending crafted requests to the Zeppelin server that bypass the authentication checks. No prior authentication or special privileges are required; the attacker only needs network access to the Zeppelin instance. The lack of proper session validation allows the attacker to assume the identity of any known or unknown user, including administrators, by manipulating authentication tokens or parameters [2].

Impact

Successful exploitation grants the attacker full access to all notebooks and resources with the privileges of the impersonated user. This can lead to unauthorized reading, modification, and deletion of notebooks, as well as exposure of sensitive data and execution of arbitrary code within the Zeppelin interpreter context. The overall impact is critical, as it compromises the confidentiality, integrity, and availability of the Zeppelin deployment [1][2].

Mitigation

A fix was released in Apache Zeppelin version 0.10.0. Users should upgrade to version 0.10.1 or later to address this vulnerability [2][4]. No known workarounds exist for unpatched versions. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.