CVE-2018-1334

Vulnerability

In Apache Spark versions 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, a different local user can connect to the Spark application and impersonate the user running the application [1][3][4]. This occurs because the local communication between the driver and executor processes lacks proper authentication, allowing any local user to connect and assume the identity of the Spark user [2].

Exploitation

An attacker must have local access to the same machine where the Spark application is running [2]. They can then connect to the Spark application's local ports and impersonate the legitimate user, potentially submitting jobs or accessing data without proper authorization [1][3]. No additional authentication or user interaction is required beyond local access [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code within the Spark application context, with the privileges of the impersonated user [1][2]. This can lead to disclosure, modification, or destruction of data processed by the Spark application, as well as potential denial of service [3].

Mitigation

Apache Spark released fixes in versions 2.2.2 and 2.3.1 [1][4]. Users should upgrade to these or later versions. If upgrade is not possible, restrict local access to the Spark application's ports and ensure only trusted users have local access to the machine [1].