Apache Zeppelin: Command Injection via CSWSH

CVE-2024-51775 describes a missing Origin validation vulnerability in Apache Zeppelin's WebSocket connections. The server fails to validate the Origin header during the WebSocket handshake, allowing any website or script from a different origin to establish a connection without restriction. This affects Zeppelin versions from 0.11.1 before 0.12.0 [1][2].

An attacker can exploit this by hosting a malicious page that opens a WebSocket to the Zeppelin server from a different origin. No authentication or special network position is required; the attacker simply needs to lure a user whose browser can reach the Zeppelin server. Once connected, the attacker can retrieve internal information about paragraphs, which may include sensitive data or configuration details [1][2].

The impact is the unauthorized disclosure of internal paragraph information, potentially leading to further attacks. The Apache security team rated this as moderate severity [2].

Mitigation is straightforward: users should upgrade to Apache Zeppelin 0.12.0, which includes a server-side Origin check for WebSocket connections as implemented in pull request #4823 [3]. No workarounds are documented.