Actively exploited in the wild
Apache Spark Command Injection Vulnerability
Apache - Spark · Listed in the CISA KEV since 2023-03-07. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-33891
HighCVSS 8.8KEVSummary
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Risk Assessment
The vulnerability allows remote code execution with the privileges of the Spark user, potentially leading to full system compromise. Organizations using Apache Spark with ACLs enabled are particularly at risk.
Recommendation
Update Apache Spark to a version later than 3.2.1 (or the appropriate fixed version). If possible, disable ACLs or restrict access to the UI.
Other vulnerabilities in Apache Spark
See all- CVE-2017-12612High
In Apache Spark versions 1.6.0 to 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine.
- CVE-2026-32773Medium
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. This CVE is marked as 'low' since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.
Original NVD description (English source)
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.