Apache Livy: Restrict file access

Vulnerability

Description

Apache Livy versions 0.7.0 and 0.8.0 contain a vulnerability that allows unauthorized file access when connecting to Apache Spark 3.1 or later [1]. The root cause is that Livy does not properly validate Spark configuration values provided by users in requests. A malicious configuration value, supported from Spark 3.1 onward, can be used to read files on the server that the user should not have access to [3].

Exploitation

Prerequisites

An attacker must have access to Apache Livy's REST or JDBC interface and be able to send requests with arbitrary Spark configuration values [1]. No additional authentication is mentioned, but the attacker needs network access to the Livy endpoint. The vulnerability is exploitable without prior authentication if the interface is exposed.

Impact

Successful exploitation allows an attacker to read arbitrary files on the Livy server that the Livy process has access to, potentially exposing sensitive data such as configuration files, credentials, or application data [3].

Mitigation

Users should upgrade to Apache Livy version 0.9.0 or later, which fixes the issue [1]. No workarounds are documented. The vulnerability affects only Livy 0.7.0 and 0.8.0 when used with Spark 3.1+.