HELK

HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...

spark-rpc-stream-unauth

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-rpc-stream-unauth spark-rpc-stream-unauth Class: Privilege leftover / File read Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2020-9480 closed unauthenticated RequestSubmitDriver /...

spark-connect-archive-fragment

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-connect-archive-fragment spark-connect-archive-fragment Class: File write Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation Spark Connect AddArtifacts names of the form archives/ split on th...

CVE-2022-33891

「💥」CVE-2022-33891 Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

spark-history-store-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-store-path spark-history-store-path Class: File write config-gated Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation HistoryServerDiskManager.appStorePath does new FileappStoreDir,...

SparkAltBatteryBoard

SparkAltBatteryBoard A custom research-oriented battery interface and telemetry board for the DJI Spark platform, built around a standard 3S LiPo battery pack instead of the discontinued, hard-to-find OEM Smart Battery. This project documents a reverse-engineered I2C/SMBus smart-battery...

spark-python-ds-static

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-python-ds-static spark-python-ds-static Class: Privilege leftover Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation DataSourceManager.dataSourceBuilders is a JVM-global first-wins map...

spark-proxyuser-classpath

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-proxyuser-classpath spark-proxyuser-classpath Class: Privilege leftover leftover of CVE-2023-22946 / SPARK-41958 Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2023-22946 / SPARK-4195...

spark-history-zip-symlink

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-zip-symlink spark-history-zip-symlink Class: File read Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation CVE-2025-54920 locked History Server Jackson so sparkEventFromJson only...

spark-connect-copy-local

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-connect-copy-local spark-connect-copy-local Class: File write leftover of SPARK-58531; static on 4.3.0 only Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation...

spark-jdbc-serde-url

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-jdbc-serde-url spark-jdbc-serde-url Class: JDBC URL injection Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation SPARK-31710 stopped scan-time extra options from overriding a stored JDBC url...

Lucky-Spark

LUCKY-SPARK ⟪ LUCKY-SPARK ⟫ is a stager designed for shellcode payloads staged with http/https like sliver or on github raw. It uses modern obfuscation and evaion methods like sliding window just-in-time decryption of the payload and cpu instruction patching. By default it creates an executable...

CVE-2022-33891

CVE-2022-33891 - Apache Spark Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author AkbarTrilaksana Description The Apache Spark UI offers the possibility to enable ACLs via the...

spark-rest-auth-bypass

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-rest-auth-bypass spark-rest-auth-bypass Class: Privilege leftover Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation Standalone Master REST is default-on port 6066 and never reads...

perwendel__spark_CVE-2018-9159_2_7_2_fixed

Spark - a tiny web framework for Java 8 NEWS : Spark 2.7.1 is out. Please try it out and report any bugs. com.sparkjava spark-core 2.7.1 Important - There is a vulnerability in older versions of Spark versions lower than 2.5.2. Please upgrade to the latest version. For documentation please go to:...

perwendel__spark_CVE-2018-9159_2-7-1

Spark - a tiny web framework for Java 8 NEWS : Spark 2.7.0 is out. Please try it out and report any bugs. com.sparkjava spark-core 2.7.0 Important - There is a vulnerability in older versions of Spark versions lower than 2.5.2. Please upgrade to the latest version. For documentation please go to:...

Apache Spark UI - Cross-Site Scripting

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint. id: CVE-2018-8024 info: name: Apache Spark UI - Cross-Site Scripting author: ritikchaddha severity: medium description: | Apache Spark UI before 2.3.2 is vulnerable to XSS via...

lab_security_apache_spark_emulation_detection

This repository does not have a README...

spark-exploit

Arbitary Code Execution in Unsecured Apache Spark Cluster How to Exploit Follow the below steps: $ git clone https://github.com/akhld/spark-exploit.git $ cd spark-exploit Remote Code Execution Open exploit.scala, Replace the following code with whatever you want to get executed! val exploit =...

project_bias

projectbias A high-performance, bias-free cryptographic stream engine written in Ada and formally verified with SPARK. The engine guarantees zero statistical bias when mapping raw entropy into custom alphabets by discarding modulo-biased values, drawing security bytes directly from native OS kern...