=====================================================================

                               CERT-Renater

                    Note d'Information No. 2024/VULN183
_____________________________________________________________________

DATE                : 09/04/2024

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Zeppelin versions prior
                                     to 0.11.0.

=====================================================================
https://lists.apache.org/thread/3od2gfpwllmtc9c5ggw04ohn8s7w3ct9
https://lists.apache.org/thread/73xdjx43yg4yz8bd4p3o8vzyybkysmn0
https://lists.apache.org/thread/csf4k73kkn3nx58pm0p2qrylbox4fvyy
https://lists.apache.org/thread/dttzkkv4qyn1rq2fdv1r94otb1osxztc
https://lists.apache.org/thread/c0zfjnow3oc3dzc8w5rbkzj8lqj5jm5x
_____________________________________________________________________


CVE-2024-31863: Apache Zeppelin: Replacing other users notebook,
bypassing any permissions
Severity: moderate

Affected versions:

- Apache Zeppelin 0.10.1 before 0.11.0


Description:

Authentication Bypass by Spoofing vulnerability by replacing to
exsiting notes in Apache Zeppelin.This issue affects Apache Zeppelin:
from 0.10.1 before 0.11.0.

Users are recommended to upgrade to version 0.11.0, which fixes the
issue.


Credit:

Esa Hiltunen (finder)
https://teragrep.com (finder)


References:

https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-31863

_____________________________________________________________________

CVE-2024-31862: Apache Zeppelin: Denial of service with invalid
notebook name

Severity: moderate

Affected versions:

- Apache Zeppelin 0.10.1 before 0.11.0


Description:

Improper Input Validation vulnerability in Apache Zeppelin when
creating a new note from Zeppelin's UI.This issue affects Apache
Zeppelin: from 0.10.1 before 0.11.0.

Users are recommended to upgrade to version 0.11.0, which fixes the
issue.


Credit:

Esa Hiltunen (finder)
https://teragrep.com (finder)


References:

https://github.com/apache/zeppelin/pull/4632
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-31862

_____________________________________________________________________

CVE-2022-47894: Apache Zeppelin SAP: connecting to a malicious SAP
server allowed it to perform XXE

Severity: moderate

Affected versions:

- Apache Zeppelin SAP 0.8.0 before 0.11.0


Description:

Improper Input Validation vulnerability in Apache Zeppelin SAP.This
issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0.

As this project is retired, we do not plan to release a version that
fixes this issue. Users are recommended to find an alternative or
restrict access to the instance to trusted users.

For more information, the fix already was merged in the source code
but Zeppelin decided to retire the SAP component
NOTE: This vulnerability only affects products that are no longer
supported by the maintainer.

This issue is being tracked as ZEPPELIN-5665

Credit:

kuiplatain@knownsec 404 Team (finder)


References:

https://github.com/apache/zeppelin/pull/4302
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2022-47894
https://issues.apache.org/jira/browse/ZEPPELIN-5665

_____________________________________________________________________

CVE-2021-28656: Apache Zeppelin: CSRF vulnerability in the
Credentials page

Severity: low

Affected versions:

- Apache Zeppelin through 0.9.0


Description:

Cross-Site Request Forgery (CSRF) vulnerability in Credential page of
Apache Zeppelin allows an attacker to submit malicious request.  This
issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior
versions.


Credit:

Jiang Qingzhi (finder)


References:

https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2021-28656

_____________________________________________________________________

CVE-2024-31860: Apache Zeppelin: Path traversal vulnerability
Severity: low

Affected versions:

- Apache Zeppelin 0.9.0 before 0.11.0


Description:

Improper Input Validation vulnerability in Apache Zeppelin.

By adding relative path indicators(E.g ..), attackers can see the
contents for any files in the filesystem that the server account
can access.
This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0.

Users are recommended to upgrade to version 0.11.0, which fixes
the issue.


Credit:

Kai Zhao (finder)


References:

https://github.com/apache/zeppelin/pull/4632
https://zeppelin.apache.org/
https://www.cve.org/CVERecord?id=CVE-2024-31860



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================