CVE-2018-11770

Vulnerability

Apache Spark's standalone master exposes a REST API for job submission from version 1.3.0 onward [1]. The REST API does not use the spark.authenticate.secret or any other authentication mechanism, unlike the spark-submit method [2]. This affects all versions from 1.3.0 to at least 2.4.x (as of disclosure) [3].

Exploitation

An attacker with network access to the standalone master's REST endpoint can submit driver programs without authentication [1]. The REST API is also used by Mesos when running in cluster mode (via MesosClusterDispatcher) [2]. However, the attacker cannot launch executors through this API [2].

Impact

Successful exploitation allows an attacker to run arbitrary driver code on the Spark cluster [1]. This can lead to resource consumption, information disclosure, or further compromise depending on the cluster configuration [3]. The attacker gains the ability to execute code within the Spark driver's security context [2].

Mitigation

As of the advisory date (August 2018), no patch was available, but future Spark versions (2.4.0 and later) disable the REST API by default by setting spark.master.rest.enabled to false [2]. Administrators should explicitly disable the REST API or use network controls (firewalls, authentication proxies) to restrict access to trusted networks [1]. Avoid setting spark.authenticate.secret when the REST API is enabled [2].