Bigtop Manager is a modern, AI-driven web application designed to simplify the complexity of bigdata cluster management. Provides an easy deployment solution not only for Apache Bigtop components, but also other community version bigdata components.
Apache Bigtop Manager suffer from a path traversal (Zip-Slip) and arbitrary file write vulnerability. The TarballExtractor.extract() routine unpacks service tarballs downloaded from the configured repository URL without validating archive entry paths and creates symbolic links with attacker-controlled targets, so a crafted archive can write files outside the intended extraction directory. Because extraction runs with the privileges of the Bigtop Manager stack (typically root during cluster provisioning), an attacker who can influence the repository or the served tarball can overwrite arbitrary files on the managed hosts and achieve remote code execution.