What is cve-2022-33891?

CVE-2022-33891 is a high-severity vulnerability in the Apache Spark UI. It allows attackers to perform impersonation and execute arbitrary shell commands, potentially compromising system security. This vulnerability affects Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1. Users should take necessary precautions to mitigate this risk.

Who is impacted by this?

CVE-2022-33891 impacts systems running Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1. The vulnerability allows attackers to impersonate users and execute arbitrary shell commands, compromising system security. Users should take necessary precautions to protect their data and systems.

What to do if cve-2022-33891 affected you

If you're affected by the CVE-2022-33891 vulnerability, it's crucial to take action to protect your systems. First, update your Apache Spark to a version that's not affected by the vulnerability. Next, disable the spark.acls.enable configuration setting if it's not required. Finally, consider upgrading to a supported version of Apache Spark, such as 3.4.0, and enable access control lists (ACLs) to restrict user permissions.

• Update Apache Spark to a secure version

• Disable spark.acls.enable if not needed

• Upgrade to a supported version and enable ACLs

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The Apache Spark Command Injection Vulnerability (CVE-2022-33891) is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It was added on March 7, 2023, with a due date of March 28, 2023.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-78, which involves improper neutralization of special elements used in an OS command, affecting Apache Spark UI.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Apache Spark Unauthenticated Command Injection ≈ Packet Storm

• oss-security - CVE-2023-32007: Apache Spark: Shell command injection via Spark UI

• CVE-2022-33891: Apache Spark shell command injection vulnerability via Spark UI-Apache Mail Archives

• BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA