Apache Spark UI Command Injection via ACL Impersonation

This repository contains a single Metasploit module targeting CVE-2022-33891, an unauthenticated command injection vulnerability in Apache Spark. The exploit leverages improper handling of the 'doAs' parameter when the 'spark.acls.enable' configuration is set to true, allowing remote attackers to execute arbitrary commands as the Spark application user. The module supports both in-memory command execution (using a Python reverse shell) and a dropper mode (deploying a Meterpreter reverse TCP shell), making it highly weaponized and flexible. The attack is performed over HTTP (default port 8080), and the exploit is effective against Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1. The repository is structured as a single Ruby file compatible with the Metasploit framework, and it provides both detection and exploitation capabilities, including automated payload delivery and session management.

This repository provides a working proof-of-concept (PoC) exploit for CVE-2022-33891, a command injection vulnerability in Apache Spark's UI when ACLs are enabled. The exploit is implemented in Python (poc.py) and allows an attacker to execute arbitrary shell commands on a vulnerable Spark server by abusing the 'doAs' parameter in HTTP requests. The exploit supports three modes: a vulnerability check (using a sleep test), an interactive command execution mode (blind, no output), and a reverse shell mode that connects back to an attacker-controlled host. The repository includes a docker-compose.yml file to set up a vulnerable Spark instance for testing, and a requirements.txt for Python dependencies. The main attack vector is network-based, targeting the Spark UI HTTP interface (default port 8080). The exploit is operational, providing real command execution and reverse shell capabilities, but does not include advanced features such as output retrieval or payload customization beyond the reverse shell. The repository is well-structured for both demonstration and testing of the vulnerability.

This repository contains a Python-based exploit for CVE-2022-33891, a remote code execution vulnerability in Apache Spark UI when Access Control Lists (ACLs) are enabled. The main file, 'CVE-2022-33891.py', provides both exploitation and scanning capabilities. It allows the user to test a single target or scan multiple targets for vulnerability. If a target is found to be vulnerable, the script can deploy a payload that opens either a reverse shell (connecting back to the attacker's machine) or a bind shell (listening on the target). The exploit works by sending a specially crafted HTTP POST request to the Spark UI endpoint, injecting a base64-encoded bash command that establishes the shell. The script includes interactive shell handling and multi-threaded scanning. The README.md provides background on the vulnerability, affected versions, and ethical usage guidelines. The exploit is operational, providing a working shell if the target is vulnerable and properly configured.

This repository contains a Python proof-of-concept exploit for CVE-2022-33891, a command injection vulnerability in Apache Spark's web UI. The exploit script (CVE-2022.33891.py) allows a user to test a single URL or a list of URLs for vulnerability by sending HTTP GET requests with a crafted 'doAs' parameter containing a shell command (e.g., `sleep 7`). The script measures the response time to infer if the command was executed, indicating vulnerability. The README provides background on the vulnerability, affected versions, usage instructions, and references. The exploit targets Apache Spark instances accessible over HTTP and is effective against specific vulnerable versions with ACLs enabled. No hardcoded endpoints are present; the user supplies target URLs. The repository is structured simply, with one exploit script and a README.

This repository provides a Python proof-of-concept exploit for CVE-2022-33891, a command injection vulnerability in Apache Spark. The exploit targets the Spark web interface by sending a GET request with a crafted 'doAs' parameter that injects a shell command (ping to an attacker-controlled domain). The script uses dnslog.cn to obtain a unique domain and verify if the target system performs the DNS lookup, indicating successful command execution. The repository consists of a README with usage instructions and a single Python script (cve_2022_33891_poc.py) that supports both single and batch URL testing. Detected vulnerable URLs are saved to a local file. The exploit is a POC and does not provide a weaponized or post-exploitation payload.

This repository provides a Python proof-of-concept (POC) exploit for CVE-2022-33891, a command injection vulnerability in Apache Spark's web UI. The main exploit script is 'poc.py', which allows an attacker to execute arbitrary shell commands on a vulnerable Spark instance by injecting commands into the 'doAs' parameter of HTTP requests to the Spark web interface (typically on port 8080). The exploit supports three main modes: a vulnerability check using a 'sleep' command, an interactive command injection mode, and a reverse shell mode that connects back to an attacker-controlled host. The repository includes a 'requirements.txt' for dependencies and a 'spark/docker-compose.yml' file to help set up a vulnerable Spark environment for testing. The exploit is blind (no output is returned to the attacker), so timing-based tests (like 'sleep') are used to confirm successful command execution. The README provides detailed usage instructions, affected versions, and setup guidance. The exploit targets Apache Spark versions 3.0.3 and earlier, 3.1.1 to 3.1.2, and 3.2.0 to 3.2.1, primarily on Linux platforms.