CVE-2022-33891
Apache Spark Command Injection Vulnerability
Description
CVE-2022-33891 is an OS command injection vulnerability in Apache Spark that allows a low-privileged, remote attacker to execute arbitrary shell commands on the server. The flaw exists in the Apache Spark UI's ACL (Access Control List) authentication filter, where a malicious user can impersonate another user and inject operating system commands through crafted input that is incorporated into a Unix shell command without proper sanitization. CVE-2022-33891 affects Apache Spark versions 3.0.3 and earlier, 3.1.1 through 3.1.2, and 3.2.0 through 3.2.1. With a CVSS v3.1 score of 8.8 (High severity) and an EPSS score of 93.5% (99.8th percentile), this Apache Spark vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| apache | spark | <= 3.0.3; >= 3.1.1, <= 3.1.2; >= 3.2.0, <= 3.2.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2023/05/02/1(Mailing List, Third Party Advisory)
- https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-33891(Third Party Advisory, US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 occurs when an application constructs operating system commands using externally influenced input without properly neutralizing special elements that could modify the intended command. In CVE-2022-33891, the Apache Spark UI's HttpSecurityFilter builds a Unix shell command using user-supplied input from the username parameter, allowing an attacker to inject arbitrary shell commands that execute with the privileges of the Spark process.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2022-33891 carries a CVSS v3.1 score of 8.8 (High severity), reflecting the ease of exploitation and comprehensive impact on the affected system. Attack Vector (Network): The vulnerability is exploitable remotely through the Apache Spark UI web interface, which is often exposed on network-accessible ports. Attack Complexity (Low): No special conditions, race windows, or additional information gathering are needed to exploit this flaw. Privileges Required (Low): Only low-level authentication is required, meaning any user with basic access to the Spark UI can attempt exploitation when ACLs are enabled. User Interaction (None): No action from another user or administrator is required to trigger the exploit. Confidentiality Impact (High): Successful exploitation allows reading of arbitrary files and data accessible to the Spark process. Integrity Impact (High): The attacker can modify or delete files and alter system configurations. Availability Impact (High): The attacker can disrupt or shut down the Spark service entirely. The EPSS score of 93.5% (99.8th percentile) confirms near-certain exploitation, and the command execution runs with the full privileges of the Spark user, which in many production environments has extensive access to data processing infrastructure.
Exploit Maturity
Public exploit code is available for CVE-2022-33891. A proof-of-concept exploit titled "Apache Spark Unauthenticated Command Injection" has been published on Packet Storm Security, demonstrating how to achieve remote command execution through the Spark UI's ACL mechanism. The vulnerability has also been discussed on the oss-security mailing list. CISA has confirmed active exploitation in the wild by adding CVE-2022-33891 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023. The EPSS score of 93.5% (99.8th percentile) indicates near-certain exploitation activity. The availability of public exploits combined with the low barrier to entry makes this Apache Spark command injection vulnerability a high-priority target for attackers.
Remediation
- Upgrade Apache Spark to a patched version immediately. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Upgrade to Apache Spark 3.1.3, 3.2.2, or 3.3.0 or later, which contain the fix for CVE-2022-33891.
- Restrict network access to the Apache Spark UI. Use firewall rules, network segmentation, or a reverse proxy with authentication to limit who can access the Spark UI. The web interface should never be exposed directly to the internet.
- Review and harden ACL configurations. If ACLs are enabled in Apache Spark (spark.acls.enable), ensure that the authentication mechanism is properly configured and that the underlying permission checks cannot be bypassed through user impersonation.
- Run Apache Spark with least-privilege permissions. Ensure the Spark process does not run as root or with unnecessary elevated permissions. Use dedicated service accounts with minimal required access to limit the impact of successful command injection.
- Monitor for suspicious command execution. Review system logs and process monitoring tools for unexpected shell commands originating from the Spark process. Set up alerts for unusual patterns such as network connections or file access initiated by the Spark service account.
Technical Details
CVE-2022-33891 exploits a flaw in Apache Spark's ACL implementation within the HttpSecurityFilter. When ACLs are enabled via the spark.acls.enable configuration option, the Spark UI uses an authentication filter to verify user access permissions. Impersonation Vector: The filter allows a user to specify an arbitrary username, which is then used in permission checks without proper validation. This enables user impersonation, but more critically, the username value is subsequently incorporated into a Unix shell command during the permission check process. Command Injection Mechanism: The permission check function constructs an OS command by concatenating the attacker-controlled username directly into a shell command string. Because the input is not sanitized to remove shell metacharacters (such as semicolons, pipes, or backticks), an attacker can inject additional commands that are executed by the system shell. Execution Context: The injected commands run with the privileges of the user account under which the Apache Spark process is running. In many data processing environments, this account has broad access to HDFS, data lakes, and other infrastructure components, amplifying the potential damage from successful exploitation.
Frequently Asked Questions
Is CVE-2022-33891 being actively exploited?
Yes, CVE-2022-33891 has been actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 28, 2023. Public exploit code is available on Packet Storm Security, and the EPSS score of 93.5% (99.8th percentile) confirms near-certain exploitation activity.
What products are affected by CVE-2022-33891?
CVE-2022-33891 affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1. The vulnerability is specifically in the Spark UI's ACL authentication filter and only affects installations where ACLs are enabled via the spark.acls.enable configuration option.
How do I fix CVE-2022-33891?
Upgrade Apache Spark to version 3.1.3, 3.2.2, or 3.3.0 or later. Additionally, restrict network access to the Spark UI, review ACL configurations, and ensure the Spark process runs with least-privilege permissions. See the Remediation section for detailed steps.
How severe is CVE-2022-33891?
CVE-2022-33891 is rated High severity with a CVSS v3.1 score of 8.8. The vulnerability requires only low privileges and no user interaction, making it easy to exploit. Successful exploitation results in complete compromise of confidentiality, integrity, and availability. The EPSS score of 93.5% (99.8th percentile) indicates near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.