Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, inc.
##

include('compat.inc');

if (description)
{
  script_id(182512);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/14");

  script_cve_id("CVE-2023-22946");

  script_name(english:"Apache Spark < 3.4.0 Privilege Escalation (CVE-2023-22946)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a web application that is affected by a privilege escalation vulnerability.");
  script_set_attribute(attribute:"description", value:
"In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,
limiting privileges. The application can execute code with the privileges of the submitting user, however, by
providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user,
for example those using Apache Livy to manage submitted applications. Update to Apache Spark 3.4.0 or later, and ensure
that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of 'false', and is not overridden
by submitted applications.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://lists.apache.org/thread/yllfl25xh5tbotjmg93zrq4bzwhqc0gv");
  script_set_attribute(attribute:"solution", value:
"Upgrade Apache Spark to 3.4.0, or later and ensure the configuration is set as specified in the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-22946");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/04/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/04/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2023/10/04");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:apache:spark");
  script_set_attribute(attribute:"enable_cgi_scanning", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2023-2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("apache_spark_detect.nbin");
  script_require_keys("installed_sw/Apache Spark");
  script_require_ports("Services/www", 7077, 8080, 8081, 9090, 6066, 4040, 18080);

  exit(0);
}

include('vcf.inc');

var app = 'Apache Spark';
var app_info = vcf::combined_get_app_info(app:app);

var constraints = [
  { 'fixed_version' : '3.4.0'}
];

# Requiring paranoia as this requires an application that uses proxy-user
vcf::check_version_and_report(
  app_info:app_info,
  constraints:constraints,
  severity:SECURITY_HOLE,
  require_paranoia:TRUE);