CVE-2022-33891: Apache Spark UI ACL Bypass RCE Vulnerability

CVE-2022-33891 Overview

CVE-2022-33891 is a command injection vulnerability in the Apache Spark UI that allows authenticated attackers to execute arbitrary shell commands on affected systems. The vulnerability exists in the HttpSecurityFilter code path when ACLs are enabled via the spark.acls.enable configuration option. When an authentication filter is active, a malicious user can perform impersonation by providing an arbitrary user name, which is then used to construct a Unix shell command without proper sanitization. This results in arbitrary shell command execution under the context of the Spark service account.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Successful exploitation allows attackers to execute arbitrary commands as the Spark user, potentially leading to complete system compromise, data exfiltration, and lateral movement within enterprise environments.

Affected Products

• Apache Spark versions 3.0.3 and earlier
• Apache Spark versions 3.1.1 to 3.1.2
• Apache Spark versions 3.2.0 to 3.2.1

Discovery Timeline

• 2022-07-18 - CVE-2022-33891 published to NVD
• 2025-10-23 - Last updated in NVD database

Technical Details for CVE-2022-33891

Vulnerability Analysis

This vulnerability represents a classic command injection flaw (CWE-78) within Apache Spark's security filtering mechanism. The root cause lies in the improper handling of user-supplied input during the access control verification process. When ACLs are enabled in Apache Spark, the HttpSecurityFilter component processes authentication requests to determine whether users have appropriate permissions to view or modify applications.

The vulnerability is exploitable over the network and requires low-privileged access to initiate the attack. The exploitation does not require user interaction, making it suitable for automated attacks. Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The vulnerability stems from insufficient input validation in the HttpSecurityFilter component. When processing authentication requests with ACLs enabled, the filter allows attackers to specify an arbitrary username through the doAs parameter. This user-controlled input is subsequently passed to a permission check function that constructs a Unix shell command without proper sanitization or escaping. The unsanitized input is then executed via shell command invocation, allowing command injection through specially crafted payloads.

Attack Vector

Exploitation requires network access to the Apache Spark UI with ACLs enabled. An attacker can craft a malicious HTTP request containing shell metacharacters in the doAs parameter. When the server processes this request through the vulnerable code path, the injected commands are executed with the privileges of the Spark service account.

The attack flow involves:

1. Identifying a vulnerable Apache Spark instance with ACLs enabled
2. Crafting an HTTP request to the Spark UI with a malicious doAs parameter containing shell commands
3. The HttpSecurityFilter processes the request and passes the unsanitized input to the permission check function
4. The permission check function constructs and executes a shell command incorporating the attacker-controlled input
5. Arbitrary commands execute as the Spark user

For detailed exploitation techniques, refer to the Packet Storm Security Exploit documentation.

Detection Methods for CVE-2022-33891

Indicators of Compromise

• HTTP requests to Spark UI endpoints containing the doAs parameter with shell metacharacters (;, |, &, $(), backticks)
• Unusual child processes spawned by the Spark service account
• Unexpected outbound network connections from Spark nodes
• Anomalous command execution patterns in system logs associated with the Spark user

Detection Strategies

• Monitor HTTP access logs for requests containing suspicious doAs parameter values with shell escape characters
• Implement Web Application Firewall (WAF) rules to detect and block command injection patterns in URL parameters
• Deploy endpoint detection and response (EDR) solutions to monitor for anomalous process creation by Spark processes
• Analyze network traffic for unusual patterns originating from Spark UI ports (default 4040, 8080, 18080)

Monitoring Recommendations

• Enable verbose logging for Apache Spark's HttpSecurityFilter component
• Configure SIEM rules to alert on command injection indicators in web server logs
• Monitor system audit logs for shell command execution by the Spark service account
• Implement file integrity monitoring on critical Spark configuration files

How to Mitigate CVE-2022-33891

Immediate Actions Required

• Upgrade Apache Spark to version 3.1.3, 3.2.2, or 3.3.0 or later immediately
• If ACLs are not required, disable them by setting spark.acls.enable=false
• Restrict network access to Spark UI to trusted networks and administrators only
• Review system logs for evidence of prior exploitation attempts

Patch Information

Apache has released security patches addressing this vulnerability in Spark versions 3.1.3, 3.2.2, and 3.3.0. Organizations should upgrade to the latest patched version appropriate for their deployment. For additional details, refer to the Apache Mailing List Thread and the CISA Known Exploited Vulnerability catalog entry.

Workarounds

• Disable ACLs by setting spark.acls.enable=false in Spark configuration if access control is not strictly required
• Place the Spark UI behind a reverse proxy with strict input validation and WAF protection
• Implement network segmentation to limit access to Spark UI endpoints to authorized personnel only
• Use firewall rules to restrict access to Spark ports (4040, 8080, 18080) from untrusted networks

# Configuration example - Disable ACLs in spark-defaults.conf
spark.acls.enable=false

# Alternative: Restrict Spark UI binding to localhost only
spark.ui.reverseProxy=true
spark.ui.reverseProxyUrl=https://your-secure-proxy.example.com