Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Zeppelin. The attacker can inject sensitive configuration or malicious code when connecting MySQL database via JDBC driver. This issue affects Apache Zeppelin: before 0.11.1. Users are recommended to upgrade to version 0.11.1, which fixes the issue.
The vulnerability results from improper code generation control (CWE-94) in the JDBC connection handling module. An attacker can provide crafted connection parameters to a MySQL database, which Apache Zeppelin processes without proper validation. This allows injection of malicious code or manipulation of sensitive application configuration during the connection establishment process. The attack does not require authentication or user interaction, making it particularly dangerous in environments with network access to Zeppelin instances.
An attacker can gain full control over the confidentiality, integrity, and availability of the system, including executing arbitrary code on the server or intercepting sensitive configuration data.
Apache Zeppelin should be immediately updated to version 0.11.1 or later, which contains a patch that eliminates the described vulnerability.
Apache Zeppelin in all versions before 0.11.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HApache Zeppelin
APPApache< 0.11.1
Related vulnerabilities
Apache Zeppelin — wykonanie kodu przez nieprawidłowe kodowanie konfiguracji
bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spar...
The attacker can use the raft server protocol in an unauthenticated way. The attacker can see the server's res...
Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication me...
Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid ...