CVE-2023-32007
📋 TL;DR
This vulnerability allows authenticated users to impersonate arbitrary users in Apache Spark UI when ACLs are enabled, leading to arbitrary shell command execution as the Spark service account. It affects unsupported versions of Apache Spark where ACLs are configured. This is essentially a re-disclosure of CVE-2022-33891 with corrected version information.
💻 Affected Systems
- Apache Spark
📦 What is this software?
Spark by Apache
Spark by Apache
Spark by Apache
⚠️ Risk & Real-World Impact
Worst Case
Full compromise of the Spark server with arbitrary command execution as the Spark service account, potentially leading to data theft, lateral movement, or complete system takeover.
Likely Case
Authenticated attackers with access to Spark UI can execute arbitrary commands, potentially accessing sensitive data or disrupting Spark operations.
If Mitigated
With proper network segmentation and authentication controls, impact is limited to the Spark service account's permissions on the affected server.
🎯 Exploit Status
Exploitation requires authentication to Spark UI and ACLs to be enabled. The vulnerability was previously disclosed as CVE-2022-33891.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.0
Vendor Advisory: https://spark.apache.org/security.html
Restart Required: Yes
Instructions:
1. Upgrade Apache Spark to version 3.4.0 or later. 2. Restart all Spark services. 3. Verify ACL functionality if required for your use case.
🔧 Temporary Workarounds
Disable ACLs
allSet spark.acls.enable=false to remove the vulnerable code path
spark.acls.enable=false
Network Isolation
allRestrict access to Spark UI to trusted networks only
🧯 If You Can't Patch
- Disable spark.acls.enable configuration option
- Implement strict network access controls to limit Spark UI access to essential personnel only
🔍 How to Verify
Check if Vulnerable:
Check if spark.acls.enable=true in Spark configuration files and version is prior to 3.4.0Check Version:
spark-submit --versionVerify Fix Applied:
Verify Spark version is 3.4.0 or later and test ACL functionality if required📡 Detection & Monitoring
Log Indicators:
- Unusual shell commands executed by Spark process
- Authentication attempts with unusual usernames in Spark logs
- Error logs related to ACL permission checks
Network Indicators:
- Unusual outbound connections from Spark servers
- Traffic patterns suggesting command execution
SIEM Query:
source="spark.logs" AND ("spark.acls" OR "HttpSecurityFilter") AND (command_execution OR shell)🔗 References
- http://www.openwall.com/lists/oss-security/2023/05/02/1
- https://lists.apache.org/thread/poxgnxhhnzz735kr1wos366l5vdbb0nv
- https://spark.apache.org/security.html
- https://www.cve.org/CVERecord?id=CVE-2022-33891
- http://www.openwall.com/lists/oss-security/2023/05/02/1
- https://lists.apache.org/thread/poxgnxhhnzz735kr1wos366l5vdbb0nv
- https://spark.apache.org/security.html
- https://www.cve.org/CVERecord?id=CVE-2022-33891
