Apache Spark UI Remote Command Injection Vulnerability via ACL Impersonation (CVE-2022-33891)
Executive & SecOps Summary
SECOPS ASSESSMENTApache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1
Remote attackers can execute arbitrary OS shell commands with the privileges of the Spark process via crafted HTTP requests
Immediately upgrade Apache Spark to versions 3.1.3, 3.2.2, 3.3.0 or later, or disable the spark.acls.enable configuration
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Apache Spark to a patched version (3.1.3, 3.2.2, 3.3.0, or later).
# Download and extract patched Apache Spark (e.g., version 3.3.0)
wget https://archive.apache.org/dist/spark/spark-3.3.0/spark-3.3.0-bin-hadoop3.tgz
tar -xvzf spark-3.3.0-bin-hadoop3.tgz
# Update symbolic links to point to the patched version
rm -f /opt/spark
ln -s /opt/spark-3.3.0-bin-hadoop3 /opt/spark2. Temporary Workaround & Hardening Configuration
If upgrading immediately is not feasible, disable Spark UI ACLs in spark-defaults.conf or restrict network access to the Spark UI ports.
# Disable ACLs in spark-defaults.conf
sed -i 's/spark.acls.enable.*/spark.acls.enable false/g' /opt/spark/conf/spark-defaults.conf
# Restrict access to Spark UI port (default: 4040) using iptables
iptables -A INPUT -p tcp -s 10.0.0.0/8 --dport 4040 -j ACCEPT
iptables -A INPUT -p tcp --dport 4040 -j DROP3. Log Audit & IoC Verification Commands
Inspect Spark UI access logs for suspicious query parameters containing shell metacharacters.
# Scan Spark logs for suspicious 'doAs' parameter patterns
grep -Ei 'doAs=.*[%20|%60|%3b|%26|%7c|\`|;|\||&]' /var/log/spark/*.log
# Verify current Spark version and ACL configuration status
echo '=== Spark Version ==='
/opt/spark/bin/spark-submit --version 2>&1 | grep -i version
echo '=== ACL Configuration ==='
grep -i 'spark.acls.enable' /opt/spark/conf/spark-defaults.conf || echo 'spark.acls.enable is not explicitly configured'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the Apache Spark UI when the Access Control Lists (ACLs) configuration option spark.acls.enable is enabled. Within the HttpSecurityFilter authentication filter, a specific code path fails to properly sanitize user-supplied input when performing user impersonation checks. By providing an arbitrary username, an attacker can bypass authentication checks and reach a permission verification function that dynamically constructs and executes a Unix shell command based on the untrusted input, leading to Command Injection (CWE-78).
2. Exploitation Mechanics & Attack Scenario
An attacker with network access to the Spark UI can send a crafted HTTP GET request containing malicious shell metacharacters (such as backticks, semicolons, or pipes) within the query parameters (e.g., ?doAs=). The HttpSecurityFilter processes this parameter without validation and passes it to an internal command execution routine (such as running id -Gn to check group membership). This allows the injected commands to be executed on the host operating system under the context of the user running the Spark application.
3. Infrastructure & Business Impact
As a CISA KEV-listed vulnerability, this flaw is actively exploited in the wild. Successful exploitation allows unauthenticated remote attackers to achieve full Remote Code Execution (RCE) on the Spark cluster nodes. This can lead to complete system compromise, data exfiltration, deployment of ransomware or cryptocurrency miners, and lateral movement within the internal enterprise network.
Official Vendor Advisories & References
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Frequently Asked SecOps Questions (CVE-2022-33891)
FAQQ1. How critical is CVE-2022-33891 and is it actively exploited in the wild?
CVE-2022-33891 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 93.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-33891?
Primary impacted vendors include apache across spark. Scope summary: Apache Spark versions <= 3.0.3, 3.1.1 - 3.1.2, and 3.2.0 - 3.2.1 (when spark.acls.enable is set to true)
Q3. What temporary mitigations or workarounds exist for CVE-2022-33891 before patching?
[Mitigation] Immediately upgrade Apache Spark to versions 3.1.3, 3.2.2, 3.3.0 or later, or disable the spark.acls.enable configuration Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-33891
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (apache)
View Category →Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Apache Tomcat EncryptInterceptor Bypass and Sensitive Data Exposure Vulnerability (CVE-2026-34486)
[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled
Apache Tomcat EncryptInterceptor Padding Oracle Vulnerability (CVE-2026-29146) Security Advisory
[Affected Scope] Apache Tomcat deployments utilizing `EncryptInterceptor` with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).
LiteLLM Proxy Server MCP Test Endpoints Remote Code Execution Vulnerability Advisory (CVE-2026-42271)
[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.