CVE-2023-40195
📋 TL;DR
This vulnerability allows authorized Airflow users with Spark hook configuration permissions to execute arbitrary code on the Airflow node by connecting to a malicious Spark server. It affects Apache Airflow deployments with the Apache Spark provider installed where administrators granted hook configuration permissions without understanding this risk.
💻 Affected Systems
- Apache Airflow with Apache Spark Provider
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Airflow node leading to data theft, lateral movement, and persistent backdoor installation.
Likely Case
Privilege escalation by authorized users to execute unauthorized commands on the Airflow host.
If Mitigated
No impact if only fully trusted users have Spark hook configuration permissions.
🎯 Exploit Status
Exploitation requires authorized user access and ability to configure Spark hooks to point to malicious server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apache Spark Provider 4.1.3
Vendor Advisory: https://airflow.apache.org/docs/apache-airflow-providers-apache-spark/4.1.3/connections/spark.html
Restart Required: Yes
Instructions:
1. Upgrade Apache Spark Provider to version 4.1.3 or later using pip: pip install --upgrade apache-airflow-providers-apache-spark>=4.1.3
2. Restart Airflow services
3. Review documentation warnings about Spark hook permissions
🔧 Temporary Workarounds
Restrict Spark Hook Permissions
allLimit Spark hook configuration permissions to only fully trusted users
Review and modify Airflow RBAC/security configurations to restrict 'can_edit' permissions on Spark connections
🧯 If You Can't Patch
- Immediately review and restrict Spark hook configuration permissions to only essential, fully trusted users
- Implement network controls to restrict Airflow nodes from connecting to untrusted Spark servers
🔍 How to Verify
Check if Vulnerable:
Check installed Apache Spark Provider version: pip show apache-airflow-providers-apache-spark | grep VersionCheck Version:
pip show apache-airflow-providers-apache-spark | grep VersionVerify Fix Applied:
Confirm version is 4.1.3 or higher: pip show apache-airflow-providers-apache-spark | grep Version📡 Detection & Monitoring
Log Indicators:
- Unauthorized Spark server connections
- Suspicious Spark hook configuration changes
- Unexpected process execution from Airflow context
Network Indicators:
- Outbound connections from Airflow nodes to unknown Spark servers
- Unusual data transfers to external Spark endpoints
SIEM Query:
source="airflow" AND (event="connection_modified" OR event="hook_configured") AND connection_type="spark"