Description
Apache Zeppelin是美国阿帕奇（Apache）基金会的一款基于Web的开源笔记本应用程序。该程序支持交互式数据分析和协作文档。 Apache Zeppelin 0.8.2 到 0.11.1版本存在安全漏洞，该漏洞源于编码或转义不当，允许攻击者通过覆盖 ZEPPELIN_INTP_CLASSPATH_OVERRIDES 等配置来执行 shell 脚本或恶意代码。
Apache Zeppelin 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.cnblogs.com/LeouMaster/p/18194719
https://zhi.oscs1024.com/42860.html
https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/Apache-Zeppelin-%E6%9C%AA%E6%8E%88%E6%9D%83%E4%BB%BB%E6%84%8F%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://blog.csdn.net/YJ_12340/article/details/139506406
https://www.miggo.io/vulnerability-database/cve/CVE-2024-31861
https://zhuanlan.zhihu.com/p/694338735
https://cn-sec.com/archives/2666057.html
https://www.sxxdckj.com/cms/a/Apache-Zeppelin-dai-ma-zhi-xing-lou-dong.html
https://ddpoc.com/DVB-2025-9112.html
https://zeppelin.apache.org/security.html
https://app.opencve.io/cve/?product=zeppelin&vendor=apache
https://nvd.nist.gov/vuln/detail/CVE-2024-31862
https://access.redhat.com/security/cve/cve-2024-31866