Read the docs
TI-2022-14901 Aliases CVE-2022-33891GHSA-4x9r-j582-cgr8

Apache Spark shell command injection vulnerability via Spark UI

Priority CRITICAL 97Exploited in the wildCWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Why it matters now

Exploitation Active In CISA KEV since 2023-03-07CISA due date 2023-03-28
EPSS 0.93244 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed org.apache.spark:spark-parent_2.12 (Maven): 3.2.2pyspark (PyPI): 3.1.3, 3.2.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Spark3.0.3 and earlier – 3.0.3; 3.1.1 to 3.1.2 – 3.1.2; 3.2.0 to 3.2.1 – 3.2.1—No fix listedCNA
—org.apache.spark:spark-parent_2.12 (Maven)up to 3.0.3—No fix listedGHSA-4x9r-j582-cgr8
—org.apache.spark:spark-parent_2.12 (Maven)3.1.1 to before 3.2.23.2.2Patch availableGHSA-4x9r-j582-cgr8
—pyspark (PyPI)before 3.1.33.1.3Patch availableGHSA-4x9r-j582-cgr8
—pyspark (PyPI)3.2.0 to before 3.2.23.2.2Patch availableGHSA-4x9r-j582-cgr8
  • Apache Spark VendorApache Affected 3.0.3 and earlier – 3.0.3; 3.1.1 to 3.1.2 – 3.1.2; 3.2.0 to 3.2.1 – 3.2.1 Fixed in — No fix listed CNA
  • org.apache.spark:spark-parent_2.12 (Maven) Vendor— Affected up to 3.0.3 Fixed in — No fix listed GHSA-4x9r-j582-cgr8
  • org.apache.spark:spark-parent_2.12 (Maven) Vendor— Affected 3.1.1 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-4x9r-j582-cgr8
  • pyspark (PyPI) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-4x9r-j582-cgr8
  • pyspark (PyPI) Vendor— Affected 3.2.0 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-4x9r-j582-cgr8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*up to 3.0.3; 3.1.1 – 3.1.2; 3.2.0 – 3.2.1VulnerableApache
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions up to 3.0.3; 3.1.1 – 3.1.2; 3.2.0 – 3.2.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-4x9r-j582-cgr8 org.apache.spark:spark-parent_2.12 (Maven) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-4x9r-j582-cgr8 pyspark (PyPI) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-4x9r-j582-cgr8 pyspark (PyPI) Fixed in 3.2.2 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat build of Apache Camel for Spring Boot 3

Timeline

  1. 2023-03-07 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2022-33891
  3. 2026-10-03 Alias added: GHSA-4x9r-j582-cgr8

References

Exploit 1

Advisory 4

Other 4

  • TI-2023-15314 Apache Spark: Shell command injection via Spark UI CVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
  • TI-2018-12289 In all versions of Apache Spark, its standalone resource manager accepts code to execute… CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences