RCE vulnerability in apache-airflow-providers-apache-sqoop 3.1.0

Disclosed: 2023-03-18 03:21:31 By leixiao To ibb
Medium
Vulnerability Details
In airflow.providers.apache.sqoop.hooks.sqoop.SqoopHook._prepare_command, users can control -libjars through libjars in Connection. -libjars makes sure each MR task gets these jars in classpath, So I can set this as a malicious Jar package, causing arbitrary system commands to be executed on the machine performing the MR task. This is a screenshot of my email reporting this vulnerability ██████████ ## Impact Remote Code Execution
Actions
View on HackerOne
Report Stats
  • Report ID: 1891795
  • State: Closed
  • Substate: resolved
  • Upvotes: 28
Share this report