CVE-2018-11770
published 2018-08-13CVE-2018-11770: From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by…
PriorityP273medium4.2CVSS 3.1
AVNACHPRLUINSUCLILAN
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
66.07%
99.2th percentile
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spark | — | — |
| apache | spark | >= 1.3.0 < 2.4.0 | 2.4.0 |
| apache_software_foundation | apache_spark | >= 1.3.0 < 2.4.0 | 2.4.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for unauthenticated HTTP POST requests to the Spark REST API job submission endpoint (default port 6066) — any submission not originating from a trusted/authorized host should be treated as suspicious. ↗
- →Alert on REST API job submissions (CreateSubmissionRequest calls) to the Spark standalone master or MesosRestSubmissionServer, especially those submitting arbitrary Java classes. ↗
- →Flag Spark deployments where 'spark.master.rest.enabled' is not explicitly set to false, as the REST API is enabled by default in affected versions (1.3.0 through pre-2.4.0). ↗
- →Detect Spark standalone master or MesosClusterDispatcher processes listening on port 6066 or 7077 that are reachable from untrusted network segments. ↗
- ·The 'spark.authenticate.secret' shared secret does NOT protect the REST API — it only authenticates spark-submit requests. Presence of this config does not mean the REST API is secured. ↗
- ·Mesos cluster mode deployments running MesosClusterDispatcher are also exposed via the REST API on port 7077 by default, not just standalone Spark masters. ↗
- ·All Spark versions from 1.3.0 up to (but not including) 2.4.0 are affected; the fix in 2.4.0 is a mitigation (documentation + config enforcement), not a full authentication implementation. ↗
CVSS provenance
nvdv3.14.2MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.04.9MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:N
vulncheck4.2MEDIUM
vendor_apache4.2
vendor_redhat4.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
spark: Missing authentication allows users to run driver programs via the REST API
vendor_redhat·2018-08-14·CVSS 4.2
CVE-2018-11770 [MEDIUM] CWE-306 spark: Missing authentication allows users to run driver programs via the REST API
spark: Missing authentication allows users to run driver programs via the REST API
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future version
Apache
Apache spark: CVE-2018-11770
vendor_apache·CVSS 4.2
CVE-2018-11770 Apache spark: CVE-2018-11770
Apache spark: CVE-2018-11770
Severity: Medium Vendor: The Apache Software Foundation Versions Affected: Spark versions from 1.3.0, running standalone master with REST API enabled, or running Mesos master with cluster mode enabled; suggested mitigations resolved the issue as of Spark 2.4.0. Description: From version 1.3.0 onward, Spark’s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit . In standalone, the config property spark.authenticate.secret establishes a shared secret for authenticating requests to submit jobs via spark-submit . However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authe
OSV
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
osv·2018-11-09
CVE-2018-11770 [MEDIUM] org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job s
GHSA
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
ghsa·2018-11-09
CVE-2018-11770 [MEDIUM] CWE-287 org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job s
VulnCheck
Apache spark Improper Authentication
vulncheck·2018·CVSS 4.2
CVE-2018-11770 [MEDIUM] Apache spark Improper Authentication
Apache spark Improper Authentication
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these
No detection rules found.
http://www.securityfocus.com/bid/105097https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3Ehttps://spark.apache.org/security.html#CVE-2018-11770http://www.securityfocus.com/bid/105097https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3Ehttps://spark.apache.org/security.html#CVE-2018-11770
2018-08-13
Published
Exploited in the wild