CVE-2022-33891
Apache Spark shell command injection vulnerability via Spark UI
- Published
- Jul 18, 2022
- Updated
- Oct 21, 2025
- Assigning CNA
- apache
- Evidence observed
- Mar 7, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Sources
modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/apache_spark_rce_cve_2022_33891.platform)
- verification: check_declared($.exploit_linux/http/apache_spark_rce_cve_2022_33891.check)
http/cves/2022/CVE-2022-33891.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: word($.matchers[*].type)
- cve-2022-33891Exploit
Python proof-of-concept for Apache Spark Shell Command Injection (CVE-2022-33891), featuring sleep-based detection, interactive command execution, and reverse shell capabilities against vulnerable Spark UIs.
「💥」CVE-2022-33891 - Apache Spark Command Injection
- CVE-2022-33891Exploit
Proof-of-concept exploit for Apache Spark command injection (CVE-2022-33891) with check and reverse shell modes, enabling authorized security testing.
- cve-2022-33891-fixResearch
Educational lab demonstrating CVE-2022-33891 exploitation and patch application for Apache Spark with ACL authentication, including PoC verification and recompilation steps.
- cve-2022-33891Exploit
Apache Spark Shell Command Injection Vulnerability
cve-2022-33891-poc
- CVE-2022-33891Exploit
CVE-2022-33891 Exploit For Apache Spark
PoC for CVE-2022-33891
For CVE-2022-33891 Apache Spark: Emulation and Detection by West Shepherd
Apache Spark RCE - CVE-2022-33891
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.