Apache Spark: Shell command injection via Spark UI

Vulnerability

Overview CVE-2023-32007 is a shell command injection vulnerability in the Apache Spark UI's HTTP security filter (HttpSecurityFilter). When ACLs are enabled via spark.acls.enable, the filter performs user impersonation based on arbitrary user names provided in requests. This impersonation triggers a permission check that constructs and executes a Unix shell command, allowing an attacker to inject arbitrary commands [1][2]. The issue was previously disclosed as CVE-2022-33891 but was incorrectly claimed to not affect version 3.1.3 [4].

Attack

Vector An attacker can exploit this vulnerability by sending crafted HTTP requests to a Spark UI endpoint on an affected cluster (versions 3.1.1 before 3.2.2) where ACLs are enabled. The attacker does not need authentication; they simply supply an arbitrary username to bypass ACL checks, reaching the vulnerable permission function. The function builds a shell command from user input, enabling arbitrary OS command execution as the Spark user [2][4].

Impact

Successful exploitation results in arbitrary shell command execution with the privileges of the Spark process. This can lead to full compromise of the Spark application, including access to data, cluster resources, and potential lateral movement within the network. The vulnerability is rated important and is marked "UNSUPPORTED WHEN ASSIGNED" for affected versions that are no longer supported [2][4].

Mitigation

Users are strongly advised to upgrade to a supported version of Apache Spark (e.g., 3.4.0 or later). For clusters still running affected unsupported versions, disabling ACLs (spark.acls.enable=false) or applying strict network access controls can reduce risk, but upgrading is the only complete fix [1][2].