CVE-2023-22946: Apache Spark privilege escalation via classpath injection

CVE-2023-22946 · Severity: low · CVSS 3.1 · Published 2023-04-17

Apache Spark is a distributed data processing framework used for large-scale analytics. A vulnerability in versions before 3.4.0 and 3.3.3 allows applications submitted with a restricted proxy user to bypass those restrictions by injecting malicious classes into the classpath, effectively escalating to the privileges of the submitting user. This is particularly dangerous in shared cluster environments managed by tools like Apache Livy.

Technologies: Apache Spark, org.apache.spark:spark-core_2.12 (Maven), org.apache.spark:spark-core_2.13 (Maven), pyspark (PyPI). Vendors: Apache, Maven, PyPI.

Quick answers

Is CVE-2023-22946 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-22946 being exploited in the wild.
How severe is CVE-2023-22946?
Low severity, with a CVSS score of 3.1, published 17 April 2023.
Which products and versions are affected?
Apache Spark 2.0 through 3.3.2 (excluding 3.3.3, 3.4.0+); org.apache.spark:spark-core_2.12 (Maven) ECOSYSTEM:introduced=0,fixed=3.3.3; org.apache.spark:spark-core_2.13 (Maven) ECOSYSTEM:introduced=0,fixed=3.3.3; pyspark (PyPI) ECOSYSTEM:introduced=0,fixed=3.4.0.
Is there a fix for CVE-2023-22946?
Yes. org.apache.spark:spark-core_2.12 (Maven): upgrade to 3.3.3 or later; org.apache.spark:spark-core_2.13 (Maven): upgrade to 3.3.3 or later; pyspark (PyPI): upgrade to 3.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-22946 attacked?
It is attacked over the network.
Am I affected by CVE-2023-22946?
Check whether you run Apache Spark, org.apache.spark:spark-core_2.12 (Maven), org.apache.spark:spark-core_2.13 (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.apache.spark:spark-core_2.12 (Maven): upgrade to 3.3.3 or later
    # set org.apache.spark:spark-core_2.12 to 3.3.3 in your pom.xml or build.gradle
  • org.apache.spark:spark-core_2.13 (Maven): upgrade to 3.3.3 or later
    # set org.apache.spark:spark-core_2.13 to 3.3.3 in your pom.xml or build.gradle
  • pyspark (PyPI): upgrade to 3.4.0 or later
    pip install "pyspark>=3.4.0"

Technical details

This is an improper privilege management vulnerability (CWE-269) affecting Apache Spark's proxy-user authentication mechanism. When applications are submitted using spark-submit with a proxy-user parameter to limit privileges, an attacker can bypass this restriction by providing malicious configuration-related classes on the classpath. The vulnerability exists because Spark did not properly validate classpath entries in cluster mode when proxy-user was enabled. An authenticated attacker with the ability to submit applications can execute arbitrary code with the submitting user's privileges rather than the restricted proxy-user. The issue is fixed in versions 3.4.0, 3.3.3, and later by introducing the configuration parameter spark.submit.proxyUser.allowCustomClasspathInClusterMode, which defaults to false to prevent custom classpath injection.

Affected products

  • Apache Spark 2.0 through 3.3.2 (excluding 3.3.3, 3.4.0+)
  • Apache PySpark 2.1.1 through 3.3.1 (excluding 3.3.2+)

Identifiers

  • CVE-2023-22946
  • GHSA-329j-jfvr-rhr6
  • PYSEC-2023-44

Timeline

  • 2023-04-17: disclosed: GHSA and CVE published
  • 2023-04-17: patched: Apache Spark 3.3.3 and 3.4.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.