⚠ Actively exploited
Added to CISA KEV on 2023-03-07. Federal agencies required to patch by 2023-03-28. Required action: Apply updates per vendor instructions..
Severity
8.8HIGH
EPSS
93.5%
top 0.17%
CISA KEV
KEV
Added 2023-03-07
Due 2023-03-28
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJul 18
KEV addedMar 7
KEV dueMar 28
Latest updateMay 2
CISA Required Action: Apply updates per vendor instructions.

Description

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input,

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

Mavenorg.apache.spark:spark-parent_2.123.1.13.2.2+1
CVEListV5apache_software_foundation/apache_spark3.1.13.2.2+3
NVDapache/spark3.1.13.1.2+2
PyPIpyspark3.1.13.2.2+4

🔴Vulnerability Details

6
GHSA
Apache Spark UI vulnerable to Command Injection2023-05-02
GHSA
Apache Spark UI can allow impersonation if ACLs enabled2022-07-19
OSV
Apache Spark UI can allow impersonation if ACLs enabled2022-07-19
CVEList
Apache Spark shell command injection vulnerability via Spark UI2022-07-18
OSV
CVE-2022-33891: The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark2022-07-18

💥Exploits & PoCs

1
Nuclei
Apache Spark UI - Remote Command Injection

📋Vendor Advisories

4
CISA
Apache Spark Command Injection Vulnerability2023-03-07
Red Hat
apache-spark: Apache Spark shell command injection vulnerability via Spark UI2022-07-18
Apache
Apache spark: CVE-2022-33891
Apache
Apache spark: CVE-2023-32007
CVE-2022-33891 (HIGH CVSS 8.8) | The Apache Spark UI offers the poss | cvebase.io