CVE-2022-33891
HighPublished
Apache Spark shell command injection vulnerability via Spark UI
- Published
- Jul 18, 2022
- Updated
- Oct 21, 2025
- Assigning CNA
- apache
- Evidence observed
- Mar 7, 2023
Primary CVSS
8.8/ 10High
Loading vulnerability catalog
Apache Spark shell command injection vulnerability via Spark UI
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Python proof-of-concept for Apache Spark Shell Command Injection (CVE-2022-33891), featuring sleep-based detection, interactive command execution, and reverse shell capabilities against vulnerable Spark UIs.
「💥」CVE-2022-33891 - Apache Spark Command Injection
Proof-of-concept exploit for Apache Spark command injection (CVE-2022-33891) with check and reverse shell modes, enabling authorized security testing.
Educational lab demonstrating CVE-2022-33891 exploitation and patch application for Apache Spark with ACL authentication, including PoC verification and recompilation steps.
Apache Spark Shell Command Injection Vulnerability
A PoC exploit for CVE-2022-33891 - Apache Spark UI Remote Code Execution (RCE)
cve-2022-33891-poc
CVE-2022-33891 Exploit For Apache Spark
PoC for CVE-2022-33891
For CVE-2022-33891 Apache Spark: Emulation and Detection by West Shepherd
Apache Spark RCE - CVE-2022-33891
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.