Aller au contenu
en Se connecter
Non notée Exploitée

CVE-2022-33891 Apache Spark Command Injection Vulnerability

Exploitation active constatée

· catalogue CISA KEV
Action attendue Apply updates per vendor instructions.
Campagnes de rançongiciel Non constatée à ce jour
Faiblesse CWE-78

Description

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Produits et versions touchés

Produit Versions touchées Corrigé en
Apache Spark 3.2 premières → 3.2.1 Pas de correctif indiqué
Apache Spark 3.1 premières → 3.1.2 Pas de correctif indiqué
Apache Spark 3.0 premières → 3.0.3 Pas de correctif indiqué

Références

Chronologie

  1. Publiée
  2. Ajoutée au catalogue KEV
  3. Dernière modification

Autres CVE de Apache Spark

Les 16 CVE de Apache Spark →
CVE-2026-32773 There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to… Non notée CVE-2025-54920 This issue affects Apache Spark: before 3.5.7 and 4.0.1 Non notée CVE-2025-55039 This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0 Non notée CVE-2024-23945 Signing cookies is an application security feature that adds a digital signature to cookie data to verify its… Non notée
Suivre cette CVE