CVE-2022-33891

Apache Spark Command Injection Vulnerability

Spark

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command…

18. Jul 2022

Ausgewertete Quellen

• Hinweis
  http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
• Hinweis
  http://www.openwall.com/lists/oss-security/2023/05/02/1
• Hinweis
  https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-33891
• CISA
  Apache Spark Command Injection Vulnerability
• NVD
  CVE-2022-33891