PT-2024-24249 · Apache · Apache Zeppelin

Published 2024-04-10 · Updated 2024-06-21 · CVE-2024-31861

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Apache Zeppelin versions 0.10.1 through 0.11.0

Description A security vulnerability has been identified in Apache Zeppelin, allowing attackers to inject malicious code through the Shell interpreter. This issue affects the Shell interpreter, which can be used as a code generation gateway, enabling the execution of generated code in a normal way. Over 1,000 results have been found related to this issue.

Recommendations For Apache Zeppelin versions 0.10.1 through 0.11.0, upgrade to version 0.11.1, which does not have the Shell interpreter by default. As a temporary workaround, consider disabling the Shell interpreter until the issue is resolved.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-31861

GHSA-8PFJ-W89W-M24X

Affected Products

Apache Zeppelin

References · 15

• https://osv.dev/vulnerability/GHSA-8pfj-w89w-m24x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31861 · Security Note
• https://github.com/apache/zeppelin · Note
• https://github.com/apache/zeppelin/pull/4708 · Note
• https://twitter.com/Dinosn/status/1778281453119246389 · Twitter Post
• https://lists.apache.org/thread/99clvqrht5l5r6kzjzwg2kj94boc9sfh · Note
• https://t.me/pentestingnews/45750 · Telegram Post
• https://t.me/cvenotify/76402 · Telegram Post
• http://openwall.com/lists/oss-security/2024/04/10/8 · Note
• https://twitter.com/VulmonFeeds/status/1778106230457721146 · Twitter Post
• https://twitter.com/oss_security/status/1778154077991444708 · Twitter Post
• https://twitter.com/moton/status/1778422021350961283 · Twitter Post
• https://twitter.com/fofabot/status/1778266482855870917 · Twitter Post
• https://twitter.com/the_yellow_fall/status/1778237093384507479 · Twitter Post
• https://twitter.com/zoomeye_team/status/1778318186674520194 · Twitter Post