CVE-2022-33891 PoC — Apache Spark 操作系统操作系统命令注入漏洞

Description

PoC for CVE-2022-33891

介绍

# CVE-2022-33891 PoC
PoC for CVE-2022-33891, with ability to set custom payloads. 

Not vulnerable by default -- spark.acls.enable need to be TRUE.

## Intended Use
Usage of this script is limited to personnel who are authorised to run the payload on the target hosts for vulnerability patching purposes only. Prior to running this script, ensure you are authorised.

## Use

```
git clone https://github.com/west-wind/CVE-2022-33891.git
python cve-2022-33891.py
```

## Getting Started
This POC expects to receive all targets in a CSV file titled --> **allTargets.csv** with one column titled --> **targets**, containing all the targets that need to be scanned ex., http://12.23.45.67:9099 or http://spark.domain.com. The / will be added by the script.

Enter the payload to be executed on the target in the **POC.conf** file. 
Your host in    --> **yourHostHere** http://my_domain_here.com
Your payload in --> **yourPayloadHere** payload.sh

Made for research purposes.

## Detection SPL
```
index=web sourcetype IN (nginx, waf_logs) url=*/?doAs*
| eval decodedIndicators=urldecode(url)
| table _time src_ip dest status request url decodedIndicators
```

## Patching & References
[NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-33891)

[Apache Advisory](https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc)

[W01fh4cker](https://github.com/W01fh4cker/cve-2022-33891)

文件快照

备注