OS Command Injection in Apache Spark - CVE-2022-33891

Vulnerability identifier: #VU65380

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-33891

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the ACL feature within the Apache Spark UI. A remote user can request a specially crafted URL and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that "spark.acls.enable" option is set.

Apache Spark
IBM Cloud Pak for Watson AIOps
Cloudera Observability with IBM
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
spark
openstack-barbican-api
openstack-barbican-keystone-listener
openstack-barbican-retry
openstack-barbican-worker
python-barbican
openstack-barbican
venv-openstack-barbican-x86_64
openstack-neutron-metadata-agent
python-neutron
openstack-neutron-server
openstack-neutron-openvswitch-agent
openstack-neutron-metering-agent
openstack-neutron-macvtap-agent
openstack-neutron-linuxbridge-agent
openstack-neutron-l3-agent
openstack-neutron-ha-tool
openstack-neutron-dhcp-agent
openstack-neutron
venv-openstack-neutron-x86_64
python-heat-gbp
openstack-heat-gbp
python-horizon-plugin-gbp-ui
openstack-horizon-plugin-gbp-ui
openstack-neutron-gbp
python-neutron-gbp
venv-openstack-horizon-x86_64
venv-openstack-nova-x86_64

Install updates from vendor's website.

Apache Spark - addressed in versions 3.1.3, 3.2.2, 3.3.0
spark - update to 2.2.3-5.12.1
openstack-barbican-api - update to 7.0.1~dev24-3.17.1
openstack-barbican-keystone-listener - update to 7.0.1~dev24-3.17.1
openstack-barbican-retry - update to 7.0.1~dev24-3.17.1
openstack-barbican-worker - update to 7.0.1~dev24-3.17.1
python-barbican - update to 7.0.1~dev24-3.17.1
openstack-barbican - update to 7.0.1~dev24-3.17.1
venv-openstack-barbican-x86_64 - update to 7.0.1~dev24-3.37.1
openstack-neutron-metadata-agent - update to 13.0.8~dev209-3.43.1
python-neutron - update to 13.0.8~dev209-3.43.1
openstack-neutron-server - update to 13.0.8~dev209-3.43.1
openstack-neutron-openvswitch-agent - update to 13.0.8~dev209-3.43.1
openstack-neutron-metering-agent - update to 13.0.8~dev209-3.43.1
openstack-neutron-macvtap-agent - update to 13.0.8~dev209-3.43.1
openstack-neutron-linuxbridge-agent - update to 13.0.8~dev209-3.43.1
openstack-neutron-l3-agent - update to 13.0.8~dev209-3.43.1
openstack-neutron-ha-tool - update to 13.0.8~dev209-3.43.1
openstack-neutron-dhcp-agent - update to 13.0.8~dev209-3.43.1
openstack-neutron - update to 13.0.8~dev209-3.43.1
venv-openstack-neutron-x86_64 - update to 13.0.8~dev209-6.43.1
python-heat-gbp - update to 14.0.1~dev5-3.12.1
openstack-heat-gbp - update to 14.0.1~dev5-3.12.1
python-horizon-plugin-gbp-ui - update to 14.0.1~dev6-3.15.1
openstack-horizon-plugin-gbp-ui - update to 14.0.1~dev6-3.15.1
openstack-neutron-gbp - update to 14.0.1~dev52-3.37.1
python-neutron-gbp - update to 14.0.1~dev52-3.37.1
venv-openstack-horizon-x86_64 - update to 14.1.1~dev11-4.43.1
venv-openstack-nova-x86_64 - update to 18.3.1~dev92-3.43.1

• Exploit #9562 - CVE-2022-33891-EXPLOIT (A PoC exploit for CVE-2022-33891 - Apache Spark UI Remote Code Execution (RCE)) (February 23, 2024)
• Exploit #8349 - Apache Spark Unauthenticated Command Injection RCE (September 7, 2022)
• Exploit #8249 - CVE-2022-33891 (CVE-2022-33891 Exploit For Apache Spark) (August 14, 2022)
• Exploit #8198 - CVE-2022-33891 (「?」CVE-2022-33891 - Apache Spark Command Injection) (August 1, 2022)
• Exploit #8166 - cve-2022-33891 (Apache Spark RCE) (July 24, 2022)
• Exploit #8163 - cve-2022-33891 () (July 21, 2022)
• Exploit #8152 - cve-2022-33891 (Apache Spark Shell Command Injection Vulnerability) (July 20, 2022)
• Exploit #8151 - CVE-2022-33891 (Apache Spark Command Injection PoC Exploit for CVE-2022-33891) (July 20, 2022)
• Exploit #8150 - cve-2022-33891 (cve-2022-33891-poc) (July 18, 2022)

• https://seclists.org/oss-sec/2022/q3/51

• OS command injection in Apache Spark
• SUSE update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Cloudera Observability on Premises with IBM