CVE-2022-33891

CVE-2022-33891 - Apache Spark Command Injection Vulnerability ⚠️ For educational and authorized security research purposes only Original Exploit Authors Very grateful to the original PoC author AkbarTrilaksana Description The Apache Spark UI offers the possibility to enable ACLs via the...

HELK

HELK The Hunting ELK or simply the HELK is one of the first open source hunt platforms with advanced analytics capabilities such as SQL declarative language, graphing, structured streaming, and even machine learning via Jupyter notebooks and Apache Spark over an ELK stack. This project was...

CVE-2022-33891

「💥」CVE-2022-33891 Description The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in...

perwendel__spark_CVE-2018-9159_2_7_2_fixed

Spark - a tiny web framework for Java 8 NEWS : Spark 2.7.1 is out. Please try it out and report any bugs. com.sparkjava spark-core 2.7.1 Important - There is a vulnerability in older versions of Spark versions lower than 2.5.2. Please upgrade to the latest version. For documentation please go to:...

CVE-2026-85102

CVE-2026-85102 — Check Point Unauthenticated VPN Tunnel Establishment Exploits CVE-2026-85102 to establish an unauthenticated VPN tunnel on Check Point Security Gateway by bypassing IKE certificate chain validation. Official Check Point Advisory: sk1000117 Vulnerability CVE-2026-85102 — VPN...

spark-exploit

Arbitary Code Execution in Unsecured Apache Spark Cluster How to Exploit Follow the below steps: $ git clone https://github.com/akhld/spark-exploit.git $ cd spark-exploit Remote Code Execution Open exploit.scala, Replace the following code with whatever you want to get executed! val exploit =...

CVE-2022-33891

CVE-2022-33891 Apache Spark Vulnerability Exploit . Created By : Dr.Linux This Exploit Run With Python Version 3.7 and Newer Version Of Python...

lab_security_apache_spark_emulation_detection

This repository does not have a README...

perwendel__spark_CVE-2018-9159_2-7-1

Spark - a tiny web framework for Java 8 NEWS : Spark 2.7.0 is out. Please try it out and report any bugs. com.sparkjava spark-core 2.7.0 Important - There is a vulnerability in older versions of Spark versions lower than 2.5.2. Please upgrade to the latest version. For documentation please go to:...

Apache Spark UI - Cross-Site Scripting

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint. id: CVE-2018-8024 info: name: Apache Spark UI - Cross-Site Scripting author: ritikchaddha severity: medium description: | Apache Spark UI before 2.3.2 is vulnerable to XSS via...

Apache Spark - Authentication Bypass

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Win32_Hash

win32hash Password hashing and verification for Windows, written in Ada/SPARK. It derives a hash with PBKDF2-HMAC-SHA256 through the Windows CNG API bcrypt, generates a random salt, stores it as Base64, and wipes every secret it touches. Almost all of the code is proved with GNATprove; the few...

Apache-spark-CVE-2022-33891

Apache-spark-CVE-2022-33891 Apache Spark RCE - CVE-2022-33891 PoC Follow us Vulnmachines Platform YouTube Twitter Facebook LinkedIn...

cve-2022-33891-fix

EP3 - MAC0352 Redes deComputadores e Sistemas Distribuidos 2023 Tópico: CVE-2022-33891 Execução de comandos shell arbitrários em aplicação spark que utiliza autenticação via ACL Alunos Elinilson Vital Leoarndo Bozzetto CVE-2022-33891 Patch Instructions for Ubuntu 22.04 Prerequisites Ubuntu 22.04...

SparkAltBatteryBoard

SparkAltBatteryBoard A custom research-oriented battery interface and telemetry board for the DJI Spark platform, built around a standard 3S LiPo battery pack instead of the discontinued, hard-to-find OEM Smart Battery. This project documents a reverse-engineered I2C/SMBus smart-battery...

CVE-2018-11770

CVE-2018-11770 Apache Spark Unauthenticated Reverse Shell RCE Standalone Python 3 RCE exploit for Apache Spark rewritten from this Metasploit module Exploit POC explained here. The exploit code itself is explained here. Tested with Python 3.7 on this target. Usage:...

spark-connect-copy-local

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-connect-copy-local Write-up: https://abraxaslabs.tech/research/spark-connect-copy-local spark-connect-copy-local Class: File write leftover of SPARK-58531; static on 4.3.0 only Reach: Remote Apache Spark 4.2.0...

spark-history-store-path

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-history-store-path Write-up: https://abraxaslabs.tech/research/spark-history-store-path spark-history-store-path Class: File write config-gated Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software...

spark-proxyuser-classpath

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-proxyuser-classpath Write-up: https://abraxaslabs.tech/research/spark-proxyuser-classpath spark-proxyuser-classpath Class: Privilege leftover leftover of CVE-2023-22946 / SPARK-41958 Reach: Remote Apache Spark...

spark-python-ds-static

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · spark-python-ds-static Write-up: https://abraxaslabs.tech/research/spark-python-ds-static spark-python-ds-static Class: Privilege leftover Reach: Remote Apache Spark 4.2.0 32f72996 - Apache Software Foundation...