CVE-2025-23196: Apache Ambari: Code Injection Vulnerability in Ambari Alert Definition

[Viraj Jasani <vjasani () apache org>]

Severity: important

Affected versions:

- Apache Ambari 8 before 2.7.9

Description:

A code injection vulnerability exists in the Ambari Alert Definition 
feature, allowing authenticated users to inject and execute arbitrary 
shell commands. The vulnerability arises when defining alert scripts, 
where the script filename field is executed using `sh -c`. An attacker 
with authenticated access can exploit this vulnerability to inject 
malicious commands, leading to remote code execution on the server. The 
issue has been fixed in the latest versions of Ambari.

Credit:

Liyw979 (reporter)
robinzeng2015 (reporter)
fcgboy (reporter)
wk2025 (reporter)

References:

https://ambari.apache.org/
https://www.cve.org/CVERecord?id=CVE-2025-23196