Apache Ambari Code Injection Vulnerability in Alert Definition Feature

A code injection vulnerability has been identified in the Apache Ambari Alert Definition feature, affecting versions prior to 2.7.9. This vulnerability allows authenticated users to inject and execute arbitrary shell commands. The issue arises when alert scripts are defined, as the script filename field is executed using 'sh -c'. An attacker with authenticated access can exploit this to execute malicious commands, leading to remote code execution on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Apache Ambari is running.

Remediation

Users can upgrade to Apache Ambari version 2.7.9 or later to address this vulnerability.