Apache · Spark
CVE-2022-33891
Apache Spark shell command injection vulnerability via Spark UI
무엇인가
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
CISA: Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
할 일
Apply updates per vendor instructions.
미국 연방 기관 조치 기한: 2023년 3월 28일
Apache의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 8. | Command Injection | Struts | 높음 8.1 | 97% |
| 2026. 8. 4. | Missing Encryption of Sensitive Data | Tomcat | 높음 7.5 | 99% |
| 2026. 4. 16. | Improper Input Validation | ActiveMQ | 높음 8.8 | 98% |
| 2025. 5. 1. | Improper Escaping of Output | HTTP Server | 치명적 9.1 | >99.9% |
| 2025. 4. 1. | Path Equivalence | Tomcat | 치명적 10.0 | 99.9% |
| 2025. 2. 4. | Forced Browsing | OFBiz | 치명적 9.8 | >99.9% |
| 2024. 9. 18. | Improper Access Control | HugeGraph-Server | 치명적 9.8 | 99.2% |
| 2024. 8. 27. | Incorrect Authorization | OFBiz | 높음 8.1 | 99.4% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.