Every CVE Search/ Get API key

CVE-2022-33891

Apache Spark shell command injection vulnerability via Spark UI

8.8 HighIn KEVPublic exploitFix available

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

93.2%Up 90.7 points since Jul 18, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Record
CVE-2022-33891
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
CVE List 8.8

Apache Spark shell command injection vulnerability via Spark UI

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Record
CVE-2022-33891
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
EUVDEUVD-2022-0217 8.8

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Record
EUVD-2022-0217
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4x9r-j582-cgr8 8.7

Apache Spark UI can allow impersonation if ACLs enabled

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

A previous version of this advisory incorrectly stated that version 3.1.3 was not vulnerable. Per GHSA-59hw-j9g6-mfg3, version 3.1.3 is vulnerable and vulnerable version ranges in this advisory have been changed to reflect the correct information.

Record
GHSA-4x9r-j582-cgr8
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-78
Updated
2026-11-02
CISA KEV No score

Apache Spark Command Injection Vulnerability

Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) are enabled.

Record
CVE-2022-33891
Weakness
CWE-78
Updated
2026-11-02
OSV 8.8

Apache Spark shell command injection vulnerability via Spark UI

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Record
CVE-2022-33891
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-78
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-4x9r-j582-cgr8 8.7

Apache Spark UI can allow impersonation if ACLs enabled

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

A previous version of this advisory incorrectly stated that version 3.1.3 was not vulnerable. Per GHSA-59hw-j9g6-mfg3, version 3.1.3 is vulnerable and vulnerable version ranges in this advisory have been changed to reflect the correct information.

Record
GHSA-4x9r-j582-cgr8
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:A
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:H
Weakness
CWE-78
Updated
2026-11-02
OSVBIT-spark-2022-33891 No score

Apache Spark shell command injection vulnerability via Spark UI

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Record
BIT-spark-2022-33891
Updated
2026-11-02
OSVPYSEC-2022-236 No score

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Record
PYSEC-2022-236
Updated
2026-11-02
OSVSUSE-SU-2023:0070-1 No score

Security update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp

This update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp fixes the following issues:

Security fixes included on this update:

openstack-barbican:

  • CVE-2022-3100: Fixed an access policy bypass via query string injection (bsc#1203873).

spark:

  • CVE-2022-33891: Fixed a command injection vulnerability via Spark UI (bsc#1204326).

Non Security fixes:

Changes in openstack-barbican:

  • Add patch to address access policy bypass via query string injection. (bsc#1203873, CVE-2022-3100.)

Changes in openstack-heat-gbp:

  • Update to version group-based-policy-automation-14.0.1.dev5:
    • Add support for zed

Changes in openstack-horizon-plugin-gbp-ui:

  • Update to version group-based-policy-ui-14.0.1.dev6:

    • Add support for zed

  • Update to version group-based-policy-ui-14.0.1.dev5:

    • fix launch instance GBP issue

Changes in openstack-neutron:

  • Update to version neutron-13.0.8.dev209:

    • Update documentation link for openSUSE index

  • Update to version neutron-13.0.8.dev208:

    • fix: Fix url of Floodlight

  • Update to version neutron-13.0.8.dev207:

    • Mellanox_eth.img url expires, remove the mellanox_eth.img node

Changes in openstack-neutron:

  • Update to version neutron-13.0.8.dev209:

    • Update documentation link for openSUSE index

  • Update to version neutron-13.0.8.dev208:

    • fix: Fix url of Floodlight

  • Update to version neutron-13.0.8.dev207:

    • Mellanox_eth.img url expires, remove the mellanox_eth.img node

Changes in openstack-neutron-gbp:

  • Update to version group-based-policy-14.0.1.dev52:

    • Fix keystone notification listener

  • Update to version group-based-policy-14.0.1.dev51:

    • Support for epg subnet 2014.2.0rc1

  • Update to version group-based-policy-14.0.1.dev50:

    • Use top-level contract references 2014.2.rc1

  • Update to version group-based-policy-14.0.1.dev48:

    • Remove py37 jobs from gate 2014.2rc1

Changes in spark:

  • Avoid using bash -c in ShellBasedGroupsMappingProvider. (bsc#1204326, CVE-2022-33891)

  • Add _constraints to prevent build from running out of disk space

  • Update to version group-based-policy-14.0.1.dev47:

    • Remove python39 from voting
Record
SUSE-SU-2023:0070-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.apache.spark:spark-parent_2.12
Maven
 through 3.0.3 None known
org.apache.spark:spark-parent_2.12
Maven
 3.1.1 up to 3.2.2
3.2.2
pyspark
PyPI
 before 3.1.3
3.1.3
pyspark
PyPI
 3.2.0 up to 3.2.2
3.2.2
spark
Bitnami
 before 3.0.4, 3.1.1 up to 3.1.3, 3.2.0 up to 3.2.2
3.0.43.1.33.2.2
org.apache.spark:spark-parent_2.12
Maven
 through 3.0.3, plus listed versions
2.4.02.4.12.4.22.4.32.4.4
Show 9 moreShow less
2.4.52.4.62.4.72.4.83.0.03.0.0-preview3.0.0-preview23.0.13.0.2
 None known
org.apache.spark:spark-parent_2.12
Maven
 3.1.1 up to 3.2.2, plus listed versions
3.1.23.1.33.2.03.2.1
3.2.2
pyspark
PyPI
 before 3.1.3, plus listed versions
2.1.12.1.22.1.32.2.02.2.1
Show 22 moreShow less
2.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.83.0.03.0.13.0.23.0.33.1.13.1.2
3.1.3
pyspark
PyPI
 3.2.0 up to 3.2.2, plus listed versions
3.2.1
3.2.2
pyspark
PyPI
 before 3.1.3, 3.2.0 up to 3.2.2, plus listed versions
2.1.12.1.22.1.32.2.02.2.1
Show 23 moreShow less
2.2.22.2.32.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.4.42.4.52.4.62.4.72.4.83.0.03.0.13.0.23.0.33.1.13.1.23.2.1
3.1.33.2.2
Show 16 moreShow less
Affected packages
PackageAffectedFixed
openstack-barbican
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 7.0.1~dev24-3.17.1
7.0.1~dev24-3.17.1
openstack-heat-gbp
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 14.0.1~dev5-3.12.1
14.0.1~dev5-3.12.1
openstack-horizon-plugin-gbp-ui
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 14.0.1~dev6-3.15.1
14.0.1~dev6-3.15.1
openstack-neutron
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 13.0.8~dev209-3.43.1
13.0.8~dev209-3.43.1
openstack-neutron-gbp
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 14.0.1~dev52-3.37.1
14.0.1~dev52-3.37.1
spark
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 2.2.3-5.12.1
2.2.3-5.12.1
venv-openstack-barbican
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 7.0.1~dev24-3.37.1
7.0.1~dev24-3.37.1
venv-openstack-horizon
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 14.1.1~dev11-4.43.1
14.1.1~dev11-4.43.1
venv-openstack-neutron
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 13.0.8~dev209-6.43.1
13.0.8~dev209-6.43.1
venv-openstack-nova
SUSE:OpenStack Cloud 9
From an advisory covering 2 CVEs
 before 18.3.1~dev92-3.43.1
18.3.1~dev92-3.43.1
openstack-barbican
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 7.0.1~dev24-3.17.1
7.0.1~dev24-3.17.1
openstack-heat-gbp
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 14.0.1~dev5-3.12.1
14.0.1~dev5-3.12.1
openstack-horizon-plugin-gbp-ui
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 14.0.1~dev6-3.15.1
14.0.1~dev6-3.15.1
openstack-neutron
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 13.0.8~dev209-3.43.1
13.0.8~dev209-3.43.1
openstack-neutron-gbp
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 14.0.1~dev52-3.37.1
14.0.1~dev52-3.37.1
spark
SUSE:OpenStack Cloud Crowbar 9
From an advisory covering 2 CVEs
 before 2.2.3-5.12.1
2.2.3-5.12.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubW01fh4cker/cve-2022-338912022-07-18
MetasploitApache Spark Unauthenticated Command Injection RCE2022-07-18
PoC in GitHubHuskyHacks/cve-2022-338912022-07-19
PoC in GitHubAkbarTrilaksana/cve-2022-338912022-07-20
PoC in GitHubnanaao/CVE-2022-338912022-07-20
PoC in GitHubAmoloHT/CVE-2022-338912022-07-30
PoC in GitHubDrLinuxOfficial/CVE-2022-338912022-08-13
PoC in GitHubVulnmachines/Apache-spark-CVE-2022-338912022-08-29
PoC in GitHubps-interactive/lab_security_apache_spark_emulation_detection2022-12-06
PoC in GitHubelsvital/cve-2022-33891-fix2023-11-26
PoC in GitHubasepsaepdin/CVE-2022-338912025-01-30
NucleiApache Spark UI - Remote Command Injection

History

History
RecordedChangedSources
affected
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-33891 is a high vulnerability (CVSS 8.8) in Apache Spark, published July 18, 2022. CISA lists it as known to be exploited, since March 7, 2023. EUVD reports exploitation since March 7, 2023. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 93.2%, the 99th percentile. Fixed in org.apache.spark:spark-parent_2.12 3.2.2.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open