Apache Livy Unauthorized File Access Vulnerability

A vulnerability in Apache Livy versions 0.7.0 and 0.8.0, when connected to Apache Spark 3.1 or later, allows for unauthorized file access. This issue arises from malicious configuration requests that include Spark configuration values supported from version 3.1 onwards. Users can gain access to files they do not have permission for, provided they have access to Livy's REST or JDBC interface and can send requests with arbitrary Spark configuration values.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files, bypassing normal permission restrictions.

Remediation

Users are advised to upgrade to Apache Livy version 0.9.0 or later, which addresses this vulnerability.