Apache Ambari and Oozie XML External Entity (XXE) Vulnerability

A XML External Entity (XXE) vulnerability has been identified in Apache Ambari versions prior to 2.7.9, specifically within the Oozie project. This vulnerability allows attackers to inject malicious XML entities, exploiting insecure XML parsing that uses the DocumentBuilderFactory class without disabling external entity resolution. As a result, attackers could read arbitrary files on the server or conduct server-side request forgery (SSRF) attacks.

Impact

Exploitation of this vulnerability could lead to unauthorized file access on the server or facilitate server-side request forgery (SSRF) attacks.

Remediation

Users can upgrade to Apache Ambari 2.7.9 or the latest trunk version to address this vulnerability.