cve-2022-33891

CVE-2022-33891 Apache Spark 셸 명령 삽입 취약점 Apache Spark 셸 명령 삽입 취약점을 악용하기 위한 Python POC입니다. 다른 POC도 있지만 매우 의심스러워 보였습니다. 이 POC는 깔끔하고 간단합니다. 저는 이 익스플로잇/취약점을 발견하지 않았습니다. 단지 커뮤니티를 위한 안전한 POC를 만들고 싶었습니다 ^.^ 영향을 받는 버전 Apache Spark 버전 3.0.3 이하, 버전 3.1.13.1.2, 버전 3.2.0 3.2.1 취약한 구성 요소 root@kitploit:...

Deserialization of untrusted data

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...

CVE-2017-12612

In Apache Spark 1.6.0 until 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the loc...