[0day-rubbish] StreamSets Transformer 3.17.0 auth-mode none fallback and un-sandboxed ScalaDTransform execution to container root (8.1 primary)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-06 17:44 UTC
Importiert: 2026-10-15 08:09 UTC
Quelle-ID: full_disc
uid_hash: 007180655ce7f312d9e46460d88f77278adca07d7e50b36d59128c298c41bf8b

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in

StreamSets Transformer, the Spark-engine data-pipeline platform from

StreamSets Inc. (subsequently acquired by IBM), verified on version 3.17.0

analysed from the official container image.

Type: failing-open authentication plus un-sandboxed code injection. On the

web tier, CWE-306 and CWE-1188 with CWE-285 on the authorisation side: when

the effective http.authentication value...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss