CVE-2020-9480

In Apache Spark 2.4.5 and earlier, the standalone resource manager's master supports optional authentication (spark.authenticate) via a shared secret. A flaw in the RPC handling allows a specially-crafted request to succeed in starting application resources even without the correct shared key. This is a missing authentication check for RPCs that should require the shared secret.

To exploit this, an attacker must be able to send RPCs to the Spark master's port. No prior authentication is needed. The attack does not require any user interaction and can be performed remotely if the master endpoint is accessible. This vulnerability only affects clusters using the standalone resource manager; clusters using YARN, Mesos, or Kubernetes are not impacted.

A successful attack allows the attacker to start a Spark application on the cluster. Because Spark applications are designed to execute arbitrary code on the workers, this results in remote code execution on the host machines. An attacker can run shell commands, access local files, and establish network connections from the compromised worker node.

The Apache Spark project has addressed this issue in Spark 2.4.6 by enforcing authentication checks for the vulnerable RPCs [1]. Users should upgrade to Spark 2.4.6 or later. As a workaround, users of earlier versions can restrict network access to the master endpoint to trusted networks only [1]. The vulnerability is also tracked in the PyPA advisory database for PySpark [3].