Apache Spark Command Injection Vulnerability Allowing Arbitrary Command Execution

A command injection vulnerability has been identified in the Apache Spark UI, specifically in versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1. This vulnerability arises when Access Control Lists (ACLs) are enabled through the configuration option 'spark.acls.enable'. In such cases, the 'HttpSecurityFilter' can be exploited by impersonating a user and injecting commands that are executed in the context of the user under which Spark is running. This issue was disclosed as CVE-2022-33891 and is being tracked as SPARK-38992.

Impact

Exploitation of this vulnerability allows for arbitrary shell command execution on the server, executed as the user under which Spark is running.

Reproduction

To reproduce this vulnerability, first ensure that Apache Spark is running with ACLs enabled in the configuration. Then, access the Spark UI and provide an arbitrary user name in the 'doAs' parameter. This will trigger the impersonation and allow injection of a Unix shell command, which will be executed on the server.

Remediation

Users are advised to upgrade to Apache Spark versions 3.1.3, 3.2.2, or 3.3.0 and later.