#VU15539 Information disclosure in Apache Spark - CVE-2018-11804

Vulnerability identifier: #VU15539

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-11804

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Apache Spark
Server applications / Frameworks for developing and running applications

Vendor: Apache Foundation

Description

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists due to improper security restrictions set on the build/mvn script. A remote attacker can send a specially crafted request that submits malicious input, download and run a zinc server to speed up compilation and access sensitive information in files readable to the developer account running the build.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Apache Spark: 1.3.0 - 1.3.1, 1.4.0 - 1.4.1, 1.5.0 - 1.5.2, 1.6.0 - 1.6.3, 2.0.0 - 2.0.2, 2.1.0 - 2.1.3, 2.2.0 - 2.2.2, 2.3.0 - 2.3.2

---

External links
https://spark.apache.org/security.html#CVE-2018-11804

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.