Description
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Spark | 3.0.3 and earlier – ≤ 3.0.3, 3.1.1 to 3.1.2 – ≤ 3.1.2, 3.2.0 to 3.2.1 – ≤ 3.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | openstack-barbican | 7.0.1~dev24-3.17.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-heat-gbp | 14.0.1~dev5-3.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev6-3.15.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron | 13.0.8~dev209-3.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | openstack-neutron-gbp | 14.0.1~dev52-3.37.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud Crowbar 9 | spark | 2.2.3-5.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-barbican | 7.0.1~dev24-3.17.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-heat-gbp | 14.0.1~dev5-3.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-horizon-plugin-gbp-ui | 14.0.1~dev6-3.15.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron | 13.0.8~dev209-3.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | openstack-neutron-gbp | 14.0.1~dev52-3.37.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | spark | 2.2.3-5.12.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-barbican | 7.0.1~dev24-3.37.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-horizon | 14.1.1~dev11-4.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-neutron | 13.0.8~dev209-6.43.1 | SUSE-SU-2023:0070-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-nova | 18.3.1~dev92-3.43.1 | SUSE-SU-2023:0070-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Apache Spark Unauthenticated Command Injection RCE
exploit/linux/http/apache_spark_rce_cve_2022_33891
GitHub 10 repositories
-
HuskyHacks/cve-2022-33891 ★ 88 · Jul 19, 2022
Apache Spark Shell Command Injection Vulnerability
-
W01fh4cker/cve-2022-33891 ★ 51 · Jul 18, 2022
cve-2022-33891-poc
-
AmoloHT/CVE-2022-33891 ★ 24 · Jul 30, 2022
「💥」CVE-2022-33891 - Apache Spark Command Injection
-
AkbarTrilaksana/cve-2022-33891 ★ 3 · Jul 20, 2022
-
Vulnmachines/Apache-spark-CVE-2022-33891 ★ 1 · Aug 29, 2022
Apache Spark RCE - CVE-2022-33891
-
DrLinuxOfficial/CVE-2022-33891 ★ 1 · Aug 13, 2022
CVE-2022-33891 Exploit For Apache Spark
-
asepsaepdin/CVE-2022-33891 ★ 0 · Jan 30, 2025
-
elsvital/cve-2022-33891-fix ★ 0 · Nov 26, 2023
-
ps-interactive/lab_security_apache_spark_emulation_detection ★ 0 · Dec 6, 2022
For CVE-2022-33891 Apache Spark: Emulation and Detection by West Shepherd
-
nanaao/CVE-2022-33891 ★ 0 · Jul 20, 2022
PoC for CVE-2022-33891
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Spark UI - Remote Command Injection http/cves/2022/CVE-2022-33891.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.spark:spark-parent_2.12 | <= 3.0.3 | — | GHSA-4x9r-j582-cgr8 |
| Maven | org.apache.spark:spark-parent_2.12 | >= 3.1.1, < 3.2.2 | 3.2.2 | GHSA-4x9r-j582-cgr8 |
| PyPI | pyspark | < 3.1.3 · >= 3.2.0, < 3.2.2 | 3.1.3, 3.2.2 | PYSEC-2022-236 |
| PyPI | pyspark | < 3.1.3 | 3.1.3 | GHSA-4x9r-j582-cgr8 |
| PyPI | pyspark | >= 3.2.0, < 3.2.2 | 3.2.2 | GHSA-4x9r-j582-cgr8 |
Advisories 1
- SUSE-SU-2023:0070-1 Security update for openstack-barbican, openstack-heat-gbp, openstack-horizon-plugin-gbp-ui, openstack-neutron, openstack-neutron-gbp SUSE / openSUSE Security Updates · Feb 4, 2026