Vulnerability record · CVE-2022-33891 · published 18 July 2022
CVE-2022-33891: Apache Spark UI ACL impersonation leads to OS command injection
Apache · Spark
Apache Spark's UI ACL feature (spark.acls.enable) contains a flaw in HttpSecurityFilter where a user can supply an arbitrary username to impersonate another user. That impersonated identity reaches a permission check that builds a Unix shell command from user input, allowing arbitrary command execution as the Spark process user.
Description
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is in CISA KEV with a near-maximum EPSS score and public exploit code, and it yields remote command execution on a widely deployed data processing platform.
What it is
Apache Spark's UI ACL feature (spark.acls.enable) contains a flaw in HttpSecurityFilter where a user can supply an arbitrary username to impersonate another user. That impersonated identity reaches a permission check that builds a Unix shell command from user input, allowing arbitrary command execution as the Spark process user.
Impact
An attacker gains arbitrary shell command execution with the privileges of the account running Spark, enabling data theft, lateral movement, or full host compromise.
Attack surface
Reachable over the network through the Spark UI when ACLs are enabled; the CVSS vector indicates low privileges are required and no user interaction, though a public exploit reference describes the issue as unauthenticated.
Exploitation
CISA added it to KEV on 2023-03-07 with a 2023-03-28 remediation due, and EPSS shows a 30-day probability of 0.93076 (99.8th percentile); public exploit code is referenced.
What to do
- Upgrade Apache Spark to a version later than 3.2.1 (or the vendor-fixed release for your 3.0/3.1/3.2 branch) as directed by Apache.
- If patching is not immediately possible, disable spark.acls.enable or restrict Spark UI network access to trusted hosts only.
- Run the Spark process under a low-privilege, non-interactive service account to limit command execution impact.
- Place the Spark UI behind an authenticating reverse proxy and block direct external exposure.
Detection
- Monitor Spark UI access logs for requests containing suspicious username parameters or shell metacharacters in ACL-related fields.
- Alert on child processes spawned by the Spark JVM (java) that invoke /bin/sh, bash, or other shells.
- Hunt for outbound connections or file writes originating from the Spark host shortly after UI requests.
- Correlate Spark UI request patterns with process creation telemetry on the Spark master and worker nodes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2022-33891 to the Known Exploited Vulnerabilities catalog on 7 March 2023 as "Apache Spark Command Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 28 March 2023.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html | ExploitThird Party AdvisoryVDB Entry |
| http://www.openwall.com/lists/oss-security/2023/05/02/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc | Mailing ListThird Party Advisory |
| http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html | ExploitThird Party AdvisoryVDB Entry |
| http://www.openwall.com/lists/oss-security/2023/05/02/1 | Mailing ListThird Party Advisory |
| https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc | Mailing ListThird Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-33891 | Third Party AdvisoryUS Government Resource |
Track CVE-2022-33891 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-33891), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
