code injection vulnerability of com.alibaba.flink.ml.cluster.node.runner.python.ProcessPythonRunner.checkPythonEnvironment
- Dominant language
- Java
- Stars
- 3.6k
- Forks
- 780
- PR merge metrics
- No merged PRs in 30d
Description
**Version:**
Version from 1.5.0 until the latest(1.6.2).
**Describe the bug:**
Passing `cmd` with command of unix shell as parameter of `com.alibaba.flink.ml.cluster.node.runner.python.ProcessPythonRunner.checkPythonEnvironment(java.lang.String)` can inject malicious commands.
For example, the following code `ProcessPythonRunner.checkPythonEnvironment("/usr/bin/gnome-calculator")` will open Calculator.
**To Reproduce:**
Just execute `ProcessPythonRunner.checkPythonEnvironment("/usr/bin/gnome-calculator")`, it would reproduce it.
**Urgency:**
Due to this vulnerability, any malicious code can be executed, so the impact is large.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with com.alibaba.flink.ml.cluster.node.runner.python.ProcessPythonRunner.checkPythonEnvironment(java.lang.String) and reproduce the supplied gnome-calculator invocation. Determine how the command is executed and verify that environment checks no longer execute injected shell commands while legitimate checks continue to work.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, machine-learning
- Domain
- backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100