CVE-2022-33891: Apache Spark UI ACL Bypass
Summary
CVE-2022-33891: The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. Affects pyspark across 3 version ranges.
< 3.1.1
>= 3.1.1, < 3.1.3
>= 3.2.0, < 3.2.2
Fixed in 3.1.1, 3.1.3 or 3.2.2, depending on the release line you run. How to fix ↓
Also tracked for
- spark · Bitnami
- org.apache.spark:spark-parent_2.12 · Maven
- org.apache.spark:spark-parent_2.12 · Maven
The same CVE-2022-33891 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Spark is an open-source distributed computing system used for big data processing and analytics. It provides a web-based user interface (UI) that allows users to monitor and manage Spark applications. The UI can be configured to enable Access Control Lists (ACLs) to restrict access and actions based on user permissions. However, a vulnerability in the ACL implementation allows an attacker to perform impersonation and execute arbitrary shell commands as the user running Spark. This vulnerability affects versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1 of Apache Spark.
Vulnerability Detail
The vulnerability arises from a code path in the HttpSecurityFilter component of Apache Spark UI. When ACLs are enabled, the filter checks if a user has the necessary permissions to view or modify an application. However, due to a flaw, an attacker can provide an arbitrary user name during authentication and bypass the permission checks. This allows them to reach a function that constructs a Unix shell command based on their input and executes it. As a result, the attacker gains the ability to execute arbitrary shell commands with the privileges of the Spark user. This can lead to unauthorized access, data manipulation, or even complete compromise of the Spark environment.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.1.13.1.1pip install --upgrade "pyspark==3.1.1" -
>= 3.1.1, < 3.1.33.1.3pip install --upgrade "pyspark==3.1.3" -
>= 3.2.0, < 3.2.23.2.2pip install --upgrade "pyspark==3.2.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround is to disable ACLs in the Spark UI configuration by setting the 'spark.acls.enable' option to 'false'. This will remove the authentication and permission checks, effectively disabling the vulnerable code path. However, it is important to note that this workaround removes the access control protections provided by ACLs, so it should only be considered as a temporary measure until the upgrade can be performed.
Conclusion
The CVE-2022-33891 vulnerability in Apache Spark UI exposes a critical security flaw that allows ACL bypass and arbitrary shell command execution. Users of affected versions should upgrade to the patched versions or apply the temporary workaround of disabling ACLs. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyspark →
FAQ
Apache Spark is an open-source distributed computing system used for big data processing and analytics. It provides a high-level API for programming distributed data processing tasks and supports various data sources and processing frameworks.
The Apache Spark UI is a web-based user interface that allows users to monitor and manage Spark applications. It provides real-time information about running applications, resource usage, and job progress.
ACLs (Access Control Lists) are a security mechanism that restricts access and actions based on user permissions. In the context of Apache Spark UI, ACLs can be enabled to control which users can view or modify Spark applications.
The vulnerability allows an attacker to provide an arbitrary user name during authentication, bypassing the permission checks. This can lead to impersonation of other users and unauthorized access to their applications and data.
The vulnerability can allow an attacker to execute arbitrary shell commands with the privileges of the Spark user. This can lead to unauthorized access, data manipulation, or even complete compromise of the Spark environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for pyspark.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
