Internet Bug Bounty: RCE vulnerability in apache-airflow-providers-apache-sqoop 3.1.0

2023-03-0402:59:38

leixiao

hackerone.com

$2400

199

internet bug bounty

remote code execution

apache sqoop

arbitrary system commands

EPSS

0.002

Percentile

58.0%

JSON

In airflow.providers.apache.sqoop.hooks.sqoop.SqoopHook._prepare_command, users can control -libjars through libjars in Connection. -libjars makes sure each MR task gets these jars in classpath, So I can set this as a malicious Jar package, causing arbitrary system commands to be executed on the machine performing the MR task.

This is a screenshot of my email reporting this vulnerability
██████████