CVE-2022-33891highunder attackCWE-78

CVE-2022-33891: high-severity vulnerability in Apache Spark

Apache Spark shell command injection vulnerability via Spark UI

Published · Updated

Follow this CVE+ Monitor Apache Spark+ Monitor pyspark

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 93%
from disclosure to weaponsame day
Published on NVDJul 18
1st PoCJul 18
metasploitJul 18
CISA KEV+232d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
4 products — because the vulnerable code is not present in the product
Red Hat Fuse 7 · Red Hat Integration Camel K 1 · Red Hat JBoss Data Grid 7 · Red Hat build of Apache Camel for Spring Boot 3
Action required by CISAfederal deadline: 2023-03-28

Apply updates per vendor instructions.

In short

Apache Spark's web interface has a security flaw that allows attackers to run arbitrary system commands on the server. If ACLs are enabled, an attacker can impersonate a user and execute shell commands with Spark's privileges.

Technical detail

A code path in HttpSecurityFilter permits user impersonation when spark.acls.enable is configured, bypassing authentication checks. An attacker can inject arbitrary input into a permission check function that constructs and executes Unix shell commands, leading to remote code execution with Spark process privileges (CWE-78: OS Command Injection).

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
Apache Software Foundation · Apache Spark
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apache Spark

In the same product, most dangerous first.

CVE-2023-32007HIGHApache Spark: Shell command injection via Spark UIEPSS 75.8%CVE-2018-11770—CVE-2018-11770EPSS 66.1%CVE-2020-9480—CVE-2020-9480EPSS 30.2%CVE-2018-17190—CVE-2018-17190EPSS 8.8%CVE-2025-54920HIGHApache Spark: Spark History Server Code Execution VulnerabilityEPSS 6.3%CVE-2018-11804—CVE-2018-11804EPSS 5.7%