CVE-2022-33891
Apache Spark Command Injection Vulnerability
Published Jul 18, 2022 · updated Jun 16, 2026 · apache spark
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Timeline
Detection, updates, and resolution for this record.
Jul 18, 2022 · Catalog
Detected
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reac
Mar 7, 2023 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Mar 28, 2023 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reac
Required action
Apply updates per vendor instructions.
CISA due date Mar 28, 2023
Affected
- cpe apache/sparkversion unspecified
- vendor Apache Sparkversion unspecified
Sources
- CISA KEVCVE-2022-33891
Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.
cisa.gov - CVE.orgCVE-2022-33891
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-33891
30-day exploitation probability 93.2%
first.org - Metasploit Modulesexploit_linux/http/apache_spark_rce_cve_2022_33891
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2022-33891
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can
nvd.nist.gov