CVE-2022-33891— Apache Spark 操作系统操作系统命令注入漏洞
一分钟漏洞结论
Apache Spark是美国阿帕奇（Apache）基金会的一款支持非循环数据流和内存计算的大规模数据处理引擎。 Apache Spark 存在操作系统命令注入漏洞，该漏洞源于Apache Spark UI中的 ACL 功能中的输入验证不正确。远程攻击者利用该漏洞可以请求特制 URL 并在目标系统上执行任意操作系统命令。
公开利用映射 2
一、 漏洞 CVE-2022-33891 基础信息
漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Vulnerability Description
CVSS Information
Vulnerability Type
Vulnerability Title
Vulnerability Description
CVSS Information
Vulnerability Type
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Apache Software Foundation | Apache Spark | 3.0.3 and earlier ~ 3.0.3 | - |
|
二、漏洞 CVE-2022-33891 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | cve-2022-33891-poc | https://github.com/W01fh4cker/cve-2022-33891 | POC详情 |
| 2 | Apache Spark Shell Command Injection Vulnerability | https://github.com/HuskyHacks/cve-2022-33891 | POC详情 |
| 3 | Apache Spark Command Injection PoC Exploit for CVE-2022-33891 | https://github.com/west-wind/CVE-2022-33891 | POC详情 |
| 4 | None | https://github.com/AkbarTrilaksana/cve-2022-33891 | POC详情 |
| 5 | Apache Spark RCE | https://github.com/llraudseppll/cve-2022-33891 | POC详情 |
| 6 | 「💥」CVE-2022-33891 - Apache Spark Command Injection | https://github.com/AmoloHT/CVE-2022-33891 | POC详情 |
| 7 | CVE-2022-33891 Exploit For Apache Spark | https://github.com/DrLinuxOfficial/CVE-2022-33891 | POC详情 |
| 8 | Apache Spark RCE - CVE-2022-33891 | https://github.com/Vulnmachines/Apache-spark-CVE-2022-33891 | POC详情 |
| 9 | For CVE-2022-33891 Apache Spark: Emulation and Detection by West Shepherd | https://github.com/ps-interactive/lab_security_apache_spark_emulation_detection | POC详情 |
| 10 | None | https://github.com/IMHarman/CVE-2022-33891 | POC详情 |
| 11 | None | https://github.com/elsvital/cve-2022-33891-fix | POC详情 |
| 12 | A PoC exploit for CVE-2022-33891 - Apache Spark UI Remote Code Execution (RCE) | https://github.com/K3ysTr0K3R/CVE-2022-33891-EXPLOIT | POC详情 |
| 13 | PoC for CVE-2022-33891 | https://github.com/nanaao/CVE-2022-33891 | POC详情 |
| 14 | None | https://github.com/asepsaepdin/CVE-2022-33891 | POC详情 |
| 15 | Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow impersonation by providing an arbitrary user name. An attacker can potentially reach a permission check function that will ultimately build a Unix shell command based on input and execute it, resulting in arbitrary shell command execution. Affected versions are 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33891.yaml | POC详情 |
| 16 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E5%BC%80%E5%8F%91%E6%A1%86%E6%9E%B6%E6%BC%8F%E6%B4%9E/Apache%20Spark%20doAs%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2022-33891.md | POC详情 |
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2022-33891 的情报信息
CVE-2022-33891 公开利用代码 (1)
CVE-2022-33891 邮件列表归档 (2)
同批安全公告 · Apache Software Foundation · 2022-07-18 · 共 3 条
| CVE-2022-35741 | Apache CloudStack 代码问题漏洞 | |
| CVE-2022-36127 | Apache SkyWalking 安全漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2022-33891
匿名用户
2025-09-01 09:24:40Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) glasses Okotoks
匿名用户
2025-10-14 17:17:44Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) blue light blocker Okotoks
匿名用户
2025-10-16 18:24:15Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) eyeglasses calgary https://www.fantasticglasses.ca/
匿名用户
2025-10-17 20:21:16Fantatic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) optical Okotoks
匿名用户
2026-02-09 13:33:36Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) eyeglasses calgary https://www.fantasticglasses.ca/
匿名用户
2026-03-19 05:12:42Fantastic Glasses unit 401 235 Milliga Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) sunglasses Okotoks
匿名用户
2026-03-26 03:04:13Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) eye exam near me https://www.fantasticglasses.ca/
匿名用户
2026-03-29 06:42:56Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) progressive lenses Okotoks
匿名用户
2026-04-18 15:36:41Fantrastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) free eye teet calgary https://www.fantasticglasses.ca/
匿名用户
2026-05-27 20:35:51Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) 3 for 1 Okotoks
匿名用户
2026-07-16 16:04:27Fantastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) best optometrist calgary https://www.fantasticglasses.ca/
匿名用户
2026-08-07 14:47:19Fanbtastic Glasses unit 401 235 Milligan Dr Okotoks, AB T1S 0B8 info@fantasticglasses.ca 587-997-EYES(3937) eye glasses