Apache Spark命令注入漏洞

详细信息

漏洞类型

命令注入

漏洞描述

Apache Spark是美国阿帕奇（Apache）基金会的一款支持非循环数据流和内存计算的大规模数据处理引擎。Apache Spark UI提供了通过配置选项Spark.ACLs.enable启用ACL（非默认设置）的可能性。通过身份验证筛选器，检查用户是否具有查看或修改应用程序的访问权限。如果启用了ACL，HttpSecurityFilter中的代码路径可以允许通过提供任意用户名来执行模拟。恶意用户能够访问权限检查功能，该功能最终将根据其输入构建Unix shell命令并执行该命令。将导致当前运行的Spark用户执行任意shell命令。这会影响Apache Spark 3.0.3和更早版本、3.1.1至3.1.2以及3.2.0至3.2.1。

修复建议

从Apache网站升级至Apache Spark的最新版本（3.1.3、3.2.2、3.3.0或更高版本），获取链接： https://spark.apache.org/

参考链接

• https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc

  OSV · Mailing List · Third Party Advisory

• https://cxsecurity.com/cveshow/CVE-2022-33891/
• https://www.cybersecurity-help.cz/vdb/SB2022071809
• http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html

  OSV · Exploit · VDB Entry · Third Party Advisory

• http://www.openwall.com/lists/oss-security/2023/05/02/1

  OSV · mailing-list

• https://nvd.nist.gov/vuln/detail/CVE-2022-33891

  OSV

• https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2022-236.yaml

  OSV

• https://github.com/advisories/GHSA-4x9r-j582-cgr8

  OSV

• https://osv.dev/vulnerability/BIT-spark-2022-33891

  OSV

• https://github.com/apache/spark

  OSV

• https://osv.dev/vulnerability/GHSA-4x9r-j582-cgr8

  OSV

• https://osv.dev/vulnerability/PYSEC-2022-236

  OSV

• https://osv.dev/vulnerability/CVE-2022-33891

  OSV

• https://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html

  GitHub · Exploit · VDB Entry · Third Party Advisory

• https://www.openwall.com/lists/oss-security/2023/05/02/1

  GitHub · mailing-list

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-33891

  NVD · US Government Resource · Third Party Advisory