WaratekVRT Sign in

CVE-2022-33891 Apache Spark

Affected softwareApache Spark
Severity8.8 High CVSS 3.1 2 scores
Fixed in3.2.2
WeaknessOS command injection (CWE-78)
Published18 Jul 2022
Updated17 Jun 2026

Description

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

Exploitation status

Exploited

Confirmed real-world exploitation.
  • CISA KEV listed Confirmed exploitation in the wild. Added 2023-03-07 · remediation due 2023-03-28 · ransomware use: unknown
  • VulnCheck KEV listed Exploitation reported in the wild. 8 citations · honeypot sightings · 10 exploits · earliest 2022-12-21.
  • CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: no, technical impact: total.
  • Indexed PoC 10 indexed Published artifacts you can open, in GitHub PoC, Metasploit, Nuclei; first seen 2022-07-18.
  • EPSS 93% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.8% of all scored CVEs.

VulnCheck KEV

Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-33891 in VulnCheck (free account), which lists 3 more citations and 5 more exploit references not shown here.

EvidenceSourceDetailDate
Honeypot sighting Shadowserver honeypots Exploitation attempts seen on 357 days 2024-01-22 to 2026-11-09
Honeypot sighting VulnCheck canaries Exploitation attempts seen on 23 days 2026-04-09 to 2026-10-29
Reported exploitation microsoft.com /en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities 2022-12-21
Reported exploitation fortiguard.fortinet.com /threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation 2022-12-22
Reported exploitation cisa.gov /sites/default/files/feeds/known_exploited_vulnerabilities.json 2023-03-07
Reported exploitation 1665891.fs1.hubspotusercontent-na1.net /hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf 2024-05-10
Reported exploitation blog.cloudflare.com /application-security-report-2024-update 2024-07-11
Exploit reference VulnCheck XDB 9d36b80b7382 Exploit type: initial-access 2022-07-18
Exploit reference VulnCheck XDB 32b655f1ada0 Exploit type: initial-access 2022-07-19
Exploit reference VulnCheck XDB 1cf584d172e6 Exploit type: initial-access 2022-07-20
Exploit reference VulnCheck XDB b58818c44ca8 Exploit type: initial-access 2022-08-13
Exploit reference VulnCheck XDB 06189b8556e5 Exploit type: initial-access 2023-12-20

5 of these are GitHub repositories with fewer than 5 stars. They are listed for reference and don't count toward the exploitation status above.

IndexArtifactStarsFirst seen
GitHub PoC Apache Spark Shell Command Injection Vulnerability 88 2022-07-19
GitHub PoC cve-2022-33891-poc 51 2022-07-18
GitHub PoC 「💥」CVE-2022-33891 - Apache Spark Command Injection 24 2022-07-30
GitHub PoC AkbarTrilaksana/cve-2022-33891 3 2022-07-20
GitHub PoC Apache Spark RCE - CVE-2022-33891 1 2022-08-29
GitHub PoC CVE-2022-33891 Exploit For Apache Spark 1 2022-08-13
GitHub PoC For CVE-2022-33891 Apache Spark: Emulation and Detection by West Shepherd 2022-12-06
GitHub PoC PoC for CVE-2022-33891 2022-07-20
Nuclei Apache Spark UI - Remote Command Injection
Metasploit Apache Spark Unauthenticated Command Injection RCE (excellent rank)

Waratek protection

Protected by Waratek

Waratek has a rule that blocks attacks on this vulnerability.

Decided by A vulnerability class already blocked by an ARMR security rule
Finding Protected by Waratek's ARMR command-injection security rule, which blocks this class of attack at the JVM level without a rule written for this CVE specifically. The CVE's weakness is CWE-78: OS Command Injection.

How to mitigate CVE-2022-33891

Upgrade Apache Spark to 3.2.2 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.

Waratek RASP Runtime protection for Java applications

CVSS

8.8 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD Primary published
CVSS 3.1 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CISA-ADP Secondary

Affected software and releases

Maven packages

Affected and fixed versions, from OSV.dev
PackageIntroducedFixedLast affected
org.apache.spark:spark-parent_2.12 0 none 3.0.3
org.apache.spark:spark-parent_2.12 3.1.1 3.2.2 unbounded

Products and versions

2 products, 5 version entries
SourceVendorProductSchemeAffected versions
nvd apache spark generic ≤ 3.0.3 · ≥ 3.1.1 and ≤ 3.1.2 · ≥ 3.2.0 and ≤ 3.2.1
osv org.apache.spark spark-parent_2.12 generic ≤ 3.0.3 · ≥ 3.1.1 and ＜ 3.2.2

References

URLTags
https://github.com/apache/spark PACKAGE
https://github.com/pypa/advisory-database/tree/main/vulns/pyspark/PYSEC-2022-236.yaml WEB
https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc WEB
https://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html WEB
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-33891 WEB
https://www.openwall.com/lists/oss-security/2023/05/02/1 WEB
http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html WEB
http://www.openwall.com/lists/oss-security/2023/05/02/1 WEB

Timeline
Published2022-07-18By the CVE Program.
VulnCheck KEV: earliest evidence2022-12-21Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE.
Added to CISA KEV2023-03-07Listed in CISA's Known Exploited Vulnerabilities catalog.
NVD record modified2026-06-17NVD's own last-modified date for this record.
VulnCheck KEV: latest evidence2026-11-09Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record.