[0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary)
Researchers disclose StreamSets Transformer 3.17.0 auth fail-open and unsandboxed code execution as container root.
The 0day Rubbish Research Team disclosed flaws in StreamSets Transformer 3.17.0, verified on the official container image. The web tier can fail open on authentication (CWE-306 and CWE-1188) with insufficient authorization (CWE-285). Unsandboxed ScalaDTransform code can then execute as container root. StreamSets, later acquired by IBM, makes the Spark data-pipeline product. The report lists a primary score of 8.1 and does not claim in-the-wild exploitation.
- Affects StreamSets Transformer 3.17.0 from the official container image.
- Web authentication can fail open, with weak authorization checks.
- Unsandboxed Scala transforms can execute as container root.
- Primary score listed as 8.1; no exploitation reported.
- Vendors
- StreamSetsIBM
- Products
- StreamSets Transformer
- Organizations
- 0day Rubbish Research Team
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in StreamSets Transformer, the Spark-engine data-pipeline platform from StreamSets Inc. (subsequently acquired by IBM), verified on version 3. 17.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.