Apache · Spark
The Apache Spark web UI's access control checks, enabled through the spark.acls.enable option, contain a command injection flaw in the HttpSecurityFilter impersonation path and its permission check function. An attacker with low-privilege access who can reach the Spark UI can supply an arbitrary user name to impersonate another user, which causes the permission check to build a Unix shell command from that input and execute it as the user running Spark, without user interaction.
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
First seen exploited 5 months after disclosure. Public exploit code (PoC-in-GitHub) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
2 related vulnerabilities in the same code over 9 months.
Why these are linked: Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
Exploit via the publicly reachable Spark web UI; TRAM2 annotated sentence label
With an authentication filter, this checks whether a user has access permissions to view or modify the application
The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities.
softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files.
Arbitrary Unix shell command execution as Spark user
will ultimately build a Unix shell command based on their input, and execute it
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
2 packages in 2 ecosystems. Main package: org.apache.spark:spark-parent_2.12.
Upgrade to 3.2.2 or later
Fixes this CVE and 1 other known vulnerability in this package (CVE-2023-32007).
Set the version to 3.2.2 or later in your pom.xml or build.gradle.
The first fix for CVE-2022-33891.
| If you run | Upgrade to |
|---|---|
| 3.1.1 up to 3.2.2 | 3.2.2 |
| 3.0.3 and earlier | No fix published |
“Up to” means the second version is the fix and is not affected.
Forks, repackagings and products that include the affected code. Each has its own fixed version.
Reports are matched by finding the exact id CVE-2022-33891 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability…
3 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.