CVE-2022-33891: Apache Spark shell command injection vulnerability via Spark UI

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• apache sparkup to 3.0.3 inclusive
• apache spark3.1.1 and later · up to 3.1.2 inclusive
• apache spark3.2.0 and later · up to 3.2.1 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (apache). Independent of NVD's CPE analysis and usually ahead of it.

• Apache Software Foundation Apache Spark

  • 3.0.3 and earlier and later · up to and including 3.0.3affected
  • 3.1.1 to 3.1.2 and later · up to and including 3.1.2affected
  • 3.2.0 to 3.2.1 and later · up to and including 3.2.1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2023-32007Apache Spark: Shell command injection via Spark UI
  58Plan
• CVE-2020-9480In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) v
  48Plan
• CVE-2018-17190In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then runs that code on 'wo
  42Plan

Published before and after this one in the same product

• ← EarlierCVE-2019-10099Aug 7, 2019 · Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true.
  30Monitor
• ← EarlierCVE-2021-38296Mar 10, 2022 · Apache Spark Key Negotiation Vulnerability
  31Monitor
• Later →CVE-2022-31777Nov 1, 2022 · Apache Spark XSS vulnerability in log viewer UI Javascript
  22Monitor

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.