Read the docs
TI-2023-15314 Aliases CVE-2023-32007GHSA-59hw-j9g6-mfg3

Apache Spark: Shell command injection via Spark UI

Priority HIGH 79CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.75792 99th percentileScored 2026-11-07
Fix Fixed Apache Spark (Apache Software Foundation): 3.2.2org.apache.spark:spark-parent_2.12 (Maven): 3.2.2+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Spark3.1.1 to before 3.2.23.2.2Patch availableCNA
—org.apache.spark:spark-parent_2.12 (Maven)3.1.1 to before 3.2.23.2.2Patch availableGHSA-59hw-j9g6-mfg3
—pyspark (PyPI)3.1.1 to before 3.2.23.2.2Patch availableGHSA-59hw-j9g6-mfg3
  • Apache Spark VendorApache Affected 3.1.1 to before 3.2.2 Fixed in 3.2.2 Patch available CNA
  • org.apache.spark:spark-parent_2.12 (Maven) Vendor— Affected 3.1.1 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-59hw-j9g6-mfg3
  • pyspark (PyPI) Vendor— Affected 3.1.1 to before 3.2.2 Fixed in 3.2.2 Patch available GHSA-59hw-j9g6-mfg3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*up to 3.0.3; 3.1.1 – 3.1.3; 3.2.0 – 3.2.1VulnerableApache
  • cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:* Versions up to 3.0.3; 3.1.1 – 3.1.3; 3.2.0 – 3.2.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Spark (Apache Software Foundation) Fixed in 3.2.2
  • Fix · GHSA-59hw-j9g6-mfg3 org.apache.spark:spark-parent_2.12 (Maven) Fixed in 3.2.2 Advisory →
  • Fix · GHSA-59hw-j9g6-mfg3 pyspark (PyPI) Fixed in 3.2.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32007
  2. 2026-10-03 Alias added: GHSA-59hw-j9g6-mfg3

References

Advisory 4

Other 4

  • TI-2022-14901 Apache Spark shell command injection vulnerability via Spark UI KEVCVSS 3.1HIGH 8.8
  • TI-2020-07589 Missing authentication in Apache Spark CVSS 3.1CRITICAL 9.8
  • TI-2020-16549 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2019-14677 HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be… CVSS 3.1CRITICAL 9.1
  • TI-2018-08427 Improper authentication in Apache Spark CVSS 3.1MEDIUM 4.2
  • TI-2018-12289 In all versions of Apache Spark, its standalone resource manager accepts code to execute… CVSS 3.0CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences