Apache Spark UI doAs Command Injection

Product: Apache Spark
CVE: CVE-2022-33891
Disclosed: 2022-07-18
CVSS: 8.8
Auth: pre-auth
CISA KEV: yes
Affected: Spark <= 3.0.3, 3.1.1 - 3.1.2, 3.2.0 - 3.2.1 (with spark.acls.enable=true)
Fixed: 3.1.3, 3.2.2, 3.3.0

Summary

When Spark UI ACLs were enabled, the user name supplied in the doAs parameter ended up inside a shell command. Unauthenticated attackers could inject commands through a simple URL parameter.

Root cause

With spark.acls.enable on, HttpSecurityFilter allowed impersonation via ?doAs=, and the group-mapping lookup (ShellBasedGroupsMappingProvider) built a Unix 'id -Gn <user>' shell command with the unsanitized user name, so backticks or $() executed arbitrary commands.

Impact

Unauthenticated remote command execution as the Spark user.

Public PoC

GET /?doAs=`echo%20%22c2xlZXAgMTAK%22%20|%20base64%20-d%20|%20bash` HTTP/1.1
Host: localhost:8080

Source: HuskyHacks/cve-2022-33891

Detection

Search web logs for '?doAs=' containing backticks, $( or URL-encoded shell metacharacters; check Spark version and spark.acls.enable.

Mitigation

Upgrade to 3.1.3/3.2.2/3.3.0+ and keep the Spark UI off untrusted networks.