Apache Zeppelin: Interpreter download command does not escape malicious code injection

CVE-2024-31866

Summary

The Apache Zeppelin platform is susceptible to an improper encoding or escaping of output vulnerability, allowing attackers to exploit configuration settings such as ZEPPELIN_INTP_CLASSPATH_OVERRIDES. By manipulating these settings, an attacker could execute shell scripts or malicious code, compromising the security of the system. It is crucial for users to upgrade to version 0.11.1 or later to mitigate this issue effectively.

References