CVE-2020-9480
published 2020-06-23CVE-2020-9480: In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret…
PriorityP187critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
29.16%
98.0th percentile
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | spark | <= 2.4.5 | — |
| apache | spark | — | — |
| apache_software_foundation | apache_spark | — | — |
| oracle | business_intelligence | — | — |
Detection & IOCsextracted from sources · hover to see the quote
port6066
url/v1/submissions/create
otherorg.apache.spark.deploy.DeployMessages$RegisterApplication
otherorg.apache.spark.deploy.DeployMessages$RegisteredApplication
otherCreateSubmissionResponse
snort
alert tcp-pkt any any -> $HOME_NET any (msg:"ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request (CVE-2020-9480)"; flow:established,to_server; flowbits:isnotset,ET.ApacheSpark_AuthAttempted; flowbits:isnotset,ET.ApacheSpark_CE; flowbits:set,ET.ApacheSpark_UnauthRegisterApplication; content:"org.apache.spark.deploy.DeployMessages$RegisterApplication"; fast_pattern; reference:cve,2020-9480; reference:url,www.youtube.com/watch?v=EAzdGo-i8vE; reference:url,github.com/ayoul3/sparky/; classtype:attempted-admin; sid:2035003; rev:3; metadata:attack_target Server, created_at 2022_01_28, cve CVE_2020_9480, deployment Internal, deployment Datacenter, performance_impact Low, confidence High, signature_severity Major, updated_at 2024_03_14; target:dest_ip;)
snort
alert tcp-pkt $HOME_NET any -> any any (msg:"ET ATTACK_RESPONSE Apache Spark RPC - Unauthenticated RegisterApplication - Successfully Registered (CVE-2020-9480)"; flow:established,to_client; flowbits:isset,ET.ApacheSpark_UnauthRegisterApplication; content:"org.apache.spark.deploy.DeployMessages$RegisteredApplication"; fast_pattern; reference:cve,2020-9480; reference:url,www.youtube.com/watch?v=EAzdGo-i8vE; reference:url,github.com/ayoul3/sparky/; classtype:successful-admin; sid:2035004; rev:2; metadata:attack_target Server, created_at 2022_01_28, cve CVE_2020_9480, deployment Internal, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2022_01_28;)
- →Exploit HTTP POST targets the REST submission API endpoint /v1/submissions/create with a JSON body containing action 'CreateSubmissionRequest' and a remote JAR URL as appResource; no authentication credentials are required.
- →Successful exploitation response contains 'CreateSubmissionResponse' and either 'submissionId' or 'driverState' in the HTTP 200 body.
- →Network fingerprint for exposed vulnerable Spark Masters: FOFA query matches port 6066 with banner containing 'Spark Master'.
- →Unauthenticated RPC attack is detectable at the network layer by the presence of the RPC class string 'org.apache.spark.deploy.DeployMessages$RegisterApplication' in TCP payload to the Spark master port, without a prior auth attempt flowbit set.
- →Successful unauthenticated registration is confirmed when the server response contains 'org.apache.spark.deploy.DeployMessages$RegisteredApplication' after an unauthenticated RegisterApplication request was observed.
- →The exploit sets spark.master to point back to the target host on port 6066 within the sparkProperties JSON payload, confirming the attack vector.
- ·The vulnerability only affects Apache Spark standalone resource manager deployments with spark.authenticate enabled. Clusters using YARN, Mesos, or other resource managers are NOT affected. ↗
- ·Authentication bypass only applies when spark.authenticate (shared secret) is configured on the standalone master; the attack bypasses this control entirely. ↗
- ·As a defense-in-depth mitigation, network access to Spark cluster machines should be restricted to trusted hosts even after patching. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vulncheck9.8CRITICAL
vendor_apache9.8HIGH
vendor_oracle9.8CRITICAL
vendor_redhat9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Analytics Server (Apache Spark) — CVE-2020-9480
vendor_oracle·2021-04-15·CVSS 9.8
CVE-2020-9480 [CRITICAL] Oracle Oracle Fusion Middleware Risk Matrix: Analytics Server (Apache Spark) — CVE-2020-9480
Oracle Oracle Fusion Middleware Risk Matrix: Analytics Server (Apache Spark) vulnerability
CVE: CVE-2020-9480
CVSS: 9.8
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2021 (APR 2021)
Red Hat
apache-spark: RCE vulnerability in auth-enabled standalone master
vendor_redhat·2020-06-22·CVSS 9.8
CVE-2020-9480 [CRITICAL] CWE-287 apache-spark: RCE vulnerability in auth-enabled standalone master
apache-spark: RCE vulnerability in auth-enabled standalone master
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Package: apache-spark (Red Hat Fuse 7) - Not affected
Package: apache-spark (Red Hat Integration Camel K 1) - Not affected
Package: apache-spark (Red Hat JBoss Data Grid 7) - Not affected
Package: apache-spark (Red Hat JBoss Fuse 6) - Not affected
Apache
Apache spark: CVE-2020-9480
vendor_apache·CVSS 9.8
CVE-2020-9480 [HIGH] Apache spark: CVE-2020-9480
Apache spark: CVE-2020-9480
Severity: Important Vendor: The Apache Software Foundation Versions Affected: Apache Spark 2.4.5 and earlier Description: In Apache Spark 2.4.5 and earlier, a standalone resource manager’s master may be configured to require authentication ( spark.authenticate ) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application’s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc). Mitigation: Users should update to Spark 2.4.6 or 3.0.0. Where possible, network access to the cluster machines should be restricted to trusted hosts only. Credit: Ayoub
GHSA
Improper Authentication in Apache Spark
ghsa·2022-02-10
CVE-2020-9480 [CRITICAL] CWE-287 Improper Authentication in Apache Spark
Improper Authentication in Apache Spark
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
OSV
Improper Authentication in Apache Spark
osv·2022-02-10
CVE-2020-9480 [CRITICAL] Improper Authentication in Apache Spark
Improper Authentication in Apache Spark
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
OSV
CVE-2020-9480: In Apache Spark 2
osv·2020-06-23
CVE-2020-9480 CVE-2020-9480: In Apache Spark 2
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
VulnCheck
Apache spark Missing Authentication for Critical Function
vulncheck·2020·CVSS 9.8
CVE-2020-9480 [CRITICAL] Apache spark Missing Authentication for Critical Function
Apache spark Missing Authentication for Critical Function
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Affected: Apache spark
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://1665891.fs1.hubspotusercontent-na1.net/hubfs/166
Suricata
ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request (CVE-2020-9480)
suricata·2022-01-28·CVSS 9.8
CVE-2020-9480 [CRITICAL] ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request (CVE-2020-9480)
ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request (CVE-2020-9480)
Rule: alert tcp-pkt any any -> $HOME_NET any (msg:"ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request (CVE-2020-9480)"; flow:established,to_server; flowbits:isnotset,ET.ApacheSpark_AuthAttempted; flowbits:isnotset,ET.ApacheSpark_CE; flowbits:set,ET.ApacheSpark_UnauthRegisterApplication; content:"org.apache.spark.deploy.DeployMessages$RegisterApplication"; fast_pattern; reference:cve,2020-9480; reference:url,www.youtube.com/watch?v=EAzdGo-i8vE; reference:url,github.com/ayoul3/sparky/; classtype:attempted-admin; sid:2035003; rev:3; metadata:attack_target Server, created_at 2022_01_28, cve CVE_2020_9480, deployment Internal, deployment Datacenter, performance_impact Low, confidenc
Suricata
ET ATTACK_RESPONSE Apache Spark RPC - Unauthenticated RegisterApplication - Successfully Registered (CVE-2020-9480)
suricata·2022-01-28·CVSS 9.8
CVE-2020-9480 [CRITICAL] ET ATTACK_RESPONSE Apache Spark RPC - Unauthenticated RegisterApplication - Successfully Registered (CVE-2020-9480)
ET ATTACK_RESPONSE Apache Spark RPC - Unauthenticated RegisterApplication - Successfully Registered (CVE-2020-9480)
Rule: alert tcp-pkt $HOME_NET any -> any any (msg:"ET ATTACK_RESPONSE Apache Spark RPC - Unauthenticated RegisterApplication - Successfully Registered (CVE-2020-9480)"; flow:established,to_client; flowbits:isset,ET.ApacheSpark_UnauthRegisterApplication; content:"org.apache.spark.deploy.DeployMessages$RegisteredApplication"; fast_pattern; reference:cve,2020-9480; reference:url,www.youtube.com/watch?v=EAzdGo-i8vE; reference:url,github.com/ayoul3/sparky/; classtype:successful-admin; sid:2035004; rev:2; metadata:attack_target Server, created_at 2022_01_28, cve CVE_2020_9480, deployment Internal, deployment Datacenter, confidence Medium, signature_severity Major, updated_at 2022_
Suricata
ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)
suricata·2022-01-28·CVSS 9.8
CVE-2020-9480 [CRITICAL] ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)
ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)
Rule: alert tcp-pkt any any -> $HOME_NET any (msg:"ET EXPLOIT Apache Spark RPC - Unauthenticated RegisterApplication Request - RCE Attempt (CVE-2020-9480)"; flow:established,to_server; flowbits:isnotset,ET.ApacheSpark_AuthAttempted; flowbits:isnotset,ET.ApacheSpark_CE; flowbits:set,ET.ApacheSpark_UnauthRegisterApplication; content:"org.apache.spark.deploy.DeployMessages$RegisterApplication"; content:"spark.driver.port="; distance:0; pcre:"/^\d+..(?:[\x60\x3b\x7c]|%60|%3b|%7c|%26|(?:[\x3c\x3e\x24]|%3c|%3e|%24)(?:\x28|%28))-XX:OnOutOfMemoryError=/R"; content:"-XX:OnOutOfMemoryError="; fast_pattern; reference:cve,2020-9480; reference:url,www.youtube.com/watch?v=EAzdGo-i8vE; reference:url,g
Nuclei
Apache Spark - Authentication Bypass
nuclei·CVSS 9.8
CVE-2020-9480 [CRITICAL] Apache Spark - Authentication Bypass
Apache Spark - Authentication Bypass
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Template:
id: CVE-2020-9480
info:
name: Apache Spark - Authentication Bypass
author: riteshs4hu
severity: critical
description: |
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared
arXiv
Threat Assessment in Machine Learning based Systems
arxiv_fulltext·2022-06-30
Threat Assessment in Machine Learning based Systems
Threat Assessment in Machine Learning based Systems
Lionel Nganyewou Tidjon and Foutse Khomh, Senior Member, IEEE
The authors are with Polytechnique Montréal, Montréal, QC H3C 3A7, Canada.
E-mail: \lionel.tidjon, foutse.khomh\@polymtl.ca
## Abstract
Machine learning is a field of artificial intelligence (AI) that is becoming essential for several critical systems, making it a good target for threat actors. Threat actors exploit different Tactics, Techniques, and Procedures (TTPs) against the confidentiality, integrity, and availability of Machine Learning (ML) systems.
During the ML
cycle, they exploit adversarial TTPs to poison data and fool ML-based systems. In recent years, multiple security practices have been proposed for traditional systems but they are not enough to cope with th
Bugzilla
CVE-2020-9480 apache-spark: RCE vulnerability in auth-enabled standalone master
bugzilla·2020-10-13·CVSS 9.8
CVE-2020-9480 [CRITICAL] CVE-2020-9480 apache-spark: RCE vulnerability in auth-enabled standalone master
CVE-2020-9480 apache-spark: RCE vulnerability in auth-enabled standalone master
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Reference:
https://spark.apache.org/security.html#CVE-2020-9480
Upstream patch:
https://github.com/apache/spark/commit/61b7d446b37cecc45e6d274bbfdde3b745bf068f
Discussion:
This bug is now closed. Further updates for individual products w
https://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3Ehttps://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3Ehttps://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3Ehttps://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3Ehttps://spark.apache.org/security.html#CVE-2020-9480https://www.oracle.com/security-alerts/cpuApr2021.htmlhttps://lists.apache.org/thread.html/r03ad9fe7c07d6039fba9f2152d345274473cb0af3d8a4794a6645f4b%40%3Cuser.spark.apache.org%3Ehttps://lists.apache.org/thread.html/ra0e62a18ad080c4ce6df5e0202a27eaada75222761efc3f7238b5a3b%40%3Ccommits.doris.apache.org%3Ehttps://lists.apache.org/thread.html/rb3956440747e41940d552d377d50b144b60085e7ff727adb0e575d8d%40%3Ccommits.submarine.apache.org%3Ehttps://lists.apache.org/thread.html/ree9e87aae81852330290a478692e36ea6db47a52a694545c7d66e3e2%40%3Cdev.spark.apache.org%3Ehttps://spark.apache.org/security.html#CVE-2020-9480https://www.oracle.com/security-alerts/cpuApr2021.html
2020-06-23
Published
Exploited in the wild