Not rated
Exploited
CVE-2022-33891 Apache Spark Command Injection Vulnerability
Active exploitation observed
· CISA KEV catalogue
Required action
Apply updates per vendor instructions.
Ransomware campaigns
Not observed so far
Weakness
CWE-78
Description
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache Spark 3.2 | earliest → 3.2.1 | No fix stated |
| Apache Spark 3.1 | earliest → 3.1.2 | No fix stated |
| Apache Spark 3.0 | earliest → 3.0.3 | No fix stated |
References
- lists.apache.org lists.apache.org
- packetstormsecurity.com packetstormsecurity.com
- [oss-security] 20230502 CVE-2023-32007: Apache Spark: Shell command injection via Spark UI www.openwall.com
Timeline
- Published
- Added to the KEV catalogue
- Last modified
Other CVEs of Apache Spark
The 16 CVEs of Apache Spark →
CVE-2026-32773
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to…
Not rated
CVE-2025-54920
This issue affects Apache Spark: before 3.5.7 and 4.0.1
Not rated
CVE-2025-55039
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0
Not rated
CVE-2024-23945
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its…
Not rated