CVE-2022-33891

CVE-2022-33891 is an OS command injection flaw (CWE-78) in Apache Spark's HttpSecurityFilter, which handles access-control checks for the Spark UI. When ACLs are enabled via the spark.acls.enable configuration option, a remote party reaching the Spark UI can supply an arbitrary username that is accepted for impersonation, and that attacker-controlled input is ultimately used to build and execute a Unix shell command. A successful attacker gains arbitrary shell command execution as the operating-system user under which Spark is running, with the CVSS v3.1 vector (network vector, low complexity, low privileges, no user interaction, high C/I/A) rating this 8.8 High. It affects Apache Spark 3.0.3 and earlier, 3.1.1 through 3.1.2, and 3.2.0 through 3.2.1 — essentially deployments with ACLs enabled and a Spark UI reachable by untrusted users. Exploitation is confirmed in the wild: a public PoC exists, CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2023-03-07, and headlines report a Zerobot botnet variant spreading by exploiting Apache Spark, with EPSS at 93.1% (100th percentile).

What to do: Upgrade Apache Spark to a patched release per Apache's and CISA's vendor instructions, as the flaw is in the KEV Catalog with a required action of applying updates. As an interim mitigation, disable spark.acls.enable if ACLs are not required, and restrict network access to the Spark UI from untrusted networks or expose it only behind authentication at the network layer. Check Spark hosts for suspicious child processes or unexpected commands executed under the Spark service account, which would indicate successful exploitation.