{"id":"CVE-2022-33891","published":"2022-07-18T07:15:07Z","modified":"2026-06-17T04:49:25Z","title":"Apache Spark Command Injection Vulnerability","vendor":"Apache","product":"Spark","tier":"core","eol":null,"description":{"text":"The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.","provenance":"source","from":"NVD"},"summary":{"text":"The Apache Spark web UI's access control checks, enabled through the spark.acls.enable option, contain a command injection flaw in the HttpSecurityFilter impersonation path and its permission check function. An attacker with low-privilege access who can reach the Spark UI can supply an arbitrary user name to impersonate another user, which causes the permission check to build a Unix shell command from that input and execute it as the user running Spark, without user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:43:59Z"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.93244,"percentile":0.99835,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2023-03-07","dueDate":"2023-03-28","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc;  https://nvd.nist.gov/vuln/detail/CVE-2022-33891","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-12-21","exploitedFirstSeen":"2022-12-21","ransomware":false,"evidence":[{"url":"https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":"2022-12-21"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/4926/new-zerobot-variant-exploits-additional-vulnerabilities-for-propagation","date":"2022-12-22"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2023-03-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2022-33891","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-02-01&host_type=src&vulnerability=cve-2022-33891","date":"2024-02-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-01&host_type=src&vulnerability=cve-2022-33891","date":"2024-03-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-06&host_type=src&vulnerability=cve-2022-33891","date":"2024-03-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-07&host_type=src&vulnerability=cve-2022-33891","date":"2024-03-07"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-08&host_type=src&vulnerability=cve-2022-33891","date":"2024-03-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-03-10&host_type=src&vulnerability=cve-2022-33891","date":"2024-03-10"}],"evidenceTotal":361,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2023/05/02/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc","tags":["Mailing List","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2023/05/02/1","tags":["Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread/p847l3kopoo5bjtmxrcwk21xp6tjxqlc","tags":["Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-33891","tags":["Third Party Advisory","US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping","dataset-annotation"],"basisDetail":"claude-haiku-5-5: Exploit via the publicly reachable Spark web UI; TRAM2 annotated sentence label","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"With an authentication filter, this checks whether a user has access permissions to view or modify the application","start":106,"end":220},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities.","start":2873,"end":3092},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin","start":4458,"end":4753},{"reportId":"SRC-b3ea000916d84bc1c41a","quote":"of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability that could allow threat actors to view or execute files.","start":4548,"end":4824}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary Unix shell command execution as Spark user","mappingType":"primary_impact","evidence":[{"from":"description","quote":"will ultimately build a Unix shell command based on their input, and execute it","start":435,"end":514}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-b3ea000916d84bc1c41a","title":"Microsoft research uncovers new Zerobot capabilities","publisher":"microsoft.com","url":"http://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","date":null,"mentions":[{"quote":"The most recent distribution of Zerobot includes additional capabilities, such as exploiting vulnerabilities in Apache and Apache Spark (CVE-2021-42013 and CVE-2022-33891 respectively), and new DDoS attack capabilities.","start":2873,"end":3092},{"quote":"softwareCVE-2017-17105Zivif PR115-204-P-RSCVE-2019-10655GrandstreamCVE-2020-25223WebAdmin of Sophos SG UTMCVE-2021-42013ApacheCVE-2022-31137Roxy-WICVE-2022-33891Apache SparkZSL-2022-5717MiniDVBLinuxSince the release of Zerobot 1.1, the malware operators have removed CVE-2018-12613, a phpMyAdmin vulnerability","start":4458,"end":4767},{"quote":"4-8361\nCVE-2016-20017\nCVE-2017-17105\nCVE-2017-17215\nCVE-2018-10561\nCVE-2018-20057\nCVE-2019-10655\nCVE-2020-7209\nCVE-2020-10987\nCVE-2020-25506\nCVE-2021-35395\nCVE-2021-36260\nCVE-2021-42013\nCVE-2021-46422\nCVE-2022-22965\nCVE-2022-25075\nCVE-2022-26186\nCVE-2022-26210\nCVE-2022-30023\nCVE-2022-30525\nCVE-2022-31137\nCVE-2022-33891","start":11964,"end":12284}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.12","vulnerableRanges":["<=3.0.3",">=3.1.1, <3.2.2"],"patched":["3.2.2"],"from":["GHSA-4x9r-j582-cgr8"],"provenance":"source"},{"ecosystem":"PyPI","package":"pyspark","vulnerableRanges":["<3.1.3",">=3.2.0, <3.2.2"],"patched":["3.1.3","3.2.2"],"from":["GHSA-4x9r-j582-cgr8","PYSEC-2022-236"],"provenance":"source"}],"advisories":[{"id":"GHSA-4x9r-j582-cgr8","url":"https://github.com/advisories/GHSA-4x9r-j582-cgr8","severity":"HIGH","ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.12","vulnerableRanges":["<=3.0.3"],"patched":[],"provenance":"source","from":"GHSA"},{"id":"GHSA-4x9r-j582-cgr8","url":"https://github.com/advisories/GHSA-4x9r-j582-cgr8","severity":"HIGH","ecosystem":"Maven","package":"org.apache.spark:spark-parent_2.12","vulnerableRanges":[">=3.1.1, <3.2.2"],"patched":["3.2.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4x9r-j582-cgr8","url":"https://github.com/advisories/GHSA-4x9r-j582-cgr8","severity":"HIGH","ecosystem":"PyPI","package":"pyspark","vulnerableRanges":["<3.1.3"],"patched":["3.1.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-4x9r-j582-cgr8","url":"https://github.com/advisories/GHSA-4x9r-j582-cgr8","severity":"HIGH","ecosystem":"PyPI","package":"pyspark","vulnerableRanges":[">=3.2.0, <3.2.2"],"patched":["3.2.2"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-0217","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0217","exploited":true,"exploitedSince":"2023-03-07","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":8,"skipped":2,"earliest":"2022-07-18","earliestUrl":"https://github.com/W01fh4cker/cve-2022-33891","repos":[{"name":"HuskyHacks/cve-2022-33891","url":"https://github.com/HuskyHacks/cve-2022-33891","stars":88,"created":"2022-07-19"},{"name":"W01fh4cker/cve-2022-33891","url":"https://github.com/W01fh4cker/cve-2022-33891","stars":51,"created":"2022-07-18"},{"name":"AmoloHT/CVE-2022-33891","url":"https://github.com/AmoloHT/CVE-2022-33891","stars":24,"created":"2022-07-30"},{"name":"AkbarTrilaksana/cve-2022-33891","url":"https://github.com/AkbarTrilaksana/cve-2022-33891","stars":3,"created":"2022-07-20"},{"name":"DrLinuxOfficial/CVE-2022-33891","url":"https://github.com/DrLinuxOfficial/CVE-2022-33891","stars":1,"created":"2022-08-13"}]},"metasploit":[{"name":"Apache Spark Unauthenticated Command Injection RCE","module":"exploit/linux/http/apache_spark_rce_cve_2022_33891","type":"exploit","disclosureDate":"2022-07-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_spark_rce_cve_2022_33891.rb"}],"nuclei":[{"id":"CVE-2022-33891","name":"Apache Spark UI - Remote Command Injection","severity":"high","path":"http/cves/2022/CVE-2022-33891.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-33891.yaml"}],"first":{"date":"2022-07-18","source":"PoC-in-GitHub","url":"https://github.com/W01fh4cker/cve-2022-33891"},"provenance":"source"},"detections":{"cveRules":[{"title":"Apache Spark Shell Command Injection - ProcessCreation","id":"c8a5f584-cdc8-42cc-8cce-0398e4265de3","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/proc_creation_lnx_exploit_cve_2022_33891_spark_shell_command_injection.yml","techniques":["T1190"]},{"title":"Apache Spark Shell Command Injection - Weblogs","id":"1a9a04fd-02d1-465c-abad-d733fd409f9c","level":"high","status":"test","path":"rules-emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml","techniques":["T1190"]}]},"exploitRefs":["http://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html","https://packetstormsecurity.com/files/168309/Apache-Spark-Unauthenticated-Command-Injection.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059.004"],"provenance":"ai"}],"timeline":[{"date":"2022-07-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-33891","provenance":"source"},{"date":"2022-07-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2022-07-18","url":"https://github.com/W01fh4cker/cve-2022-33891","provenance":"source"},{"date":"2022-12-21","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.microsoft.com/en-us/security/blog/2022/12/21/microsoft-research-uncovers-new-zerobot-capabilities/","provenance":"source"},{"date":"2023-03-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2023-03-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0217","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":232},"priority":{"score":73.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1408 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9983"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 advisory exploit reference; 8 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.16,"detail":"base score 8.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-apache-spark-cve-2022-33891","children":[{"from":"CVE-2022-33891","to":"CVE-2023-32007","relation":"related","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-59hw-j9g6-mfg3","via":"reference","url":"https://www.cve.org/CVERecord?id=CVE-2022-33891"},{"kind":"osv-related","provenance":"source","id":"PYSEC-2023-72","via":"reference","url":"https://www.cve.org/CVERecord?id=CVE-2022-33891"}]}]}}