CVE-2022-33891 PoC — Apache Spark shell command injection vulnerability via Spark UI

Source

https://github.com/elsvital/cve-2022-33891-fix

Associated Vulnerability

Title: Apache Spark shell command injection vulnerability via Spark UI (CVE-2022-33891)
Description:The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Readme

# EP3 - MAC0352 Redes deComputadores e Sistemas Distribuidos 2023

## Tópico: CVE-2022-33891

### Execução de comandos shell arbitrários em aplicação spark que utiliza autenticação via ACL

## Alunos

- Elinilson Vital
- Leoarndo Bozzetto

# CVE-2022-33891 Patch Instructions for Ubuntu 22.04

## Prerequisites

- Ubuntu 22.04
- Git
- Maven
- Python 3

## Steps to Apply the Patch

1. Clone the fix repository:

```bash
git clone https://github.com/elsvital/cve-2022-33891-fix.git
```

2. Change to the Spark directory without the patch:

```bash
cd spark-3.2.0-no-patch
```

3. Compile Spark without the patch:

```bash
sudo ./build/mvn -DskipTests clean package
```

4. Start the Spark service:

```bash
sudo ./sbin/start-master.sh
```

5. Clone the vulnerability verification POC repository:

```bash
git clone https://github.com/HuskyHacks/cve-2022-33891
```

6. Navigate to the POC source directory:

```bash
cd cve-2022-33891
```

7. Verify the vulnerability:

```bash
python3 poc.py -u http://localhost -p 8080 --check --verbose
```

8. Return to the main directory:

```bash
cd ..
```

9. Stop the Spark service:

```bash
sudo ./sbin/stop-master.sh
```

10. Apply the patch from the provided link or merge the changes into your local repository.

```bash
# Access: https://github.com/apache/spark/commit/1d524a88f6e93e9971a09f70eb2804dca51d578c
```

11. Recompile Spark with the patch applied:

```
sudo ./build/mvn -DskipTests clean package
```

12. Start the Spark service again:

```
sudo ./sbin/start-master.sh
```

13. Navigate back to the POC source directory:

```
cd cve-2022-33891
```

14. Confirm the vulnerability is patched:

```
python3 poc.py -u http://localhost -p 8080 --check --verbose
```

## Video Tutorial

For a video walkthrough of the patching process, watch the tutorial at:
[![Watch the video](https://img.youtube.com/vi/zXdWVvaL58U/hqdefault.jpg)](https://youtu.be/zXdWVvaL58U)

## Additional Notes

Replace `http://localhost` with the appropriate IP address or hostname of your Spark service if necessary.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →