CVE-2022-33891

CVE-2022-33891 - Apache Spark 命令注入漏洞 ⚠️ 仅用于教育和授权的安全研究目的 原始漏洞利用作者 非常感谢原始 PoC 作者 AkbarTrilaksana 描述 Apache Spark UI 提供了通过配置选项 spark.acls.enable 启用 ACL 的功能。借助身份验证过滤器，它可以检查用户是否具有查看或修改应用程序的访问权限。如果启用了 ACL，HttpSecurityFilter 中的一条代码路径可能允许某人通过提供任意用户名来执行身份冒充。恶意用户随后可能能够访问一个权限检查函数，该函数最终会根据其输入构建 Unix shell...

SUSE CVE-2022-33891

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

GHSA-4X9R-J582-CGR8 Apache Spark UI can allow impersonation if ACLs enabled

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...

PYSEC-2022-236

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to...