Apache Spark UI 命令注入漏洞 CVE-2022-33891

合天网安实验室发布时间：2022-10-18 16:28:01 ，浏览量：0

　https://www.cnsuc.net/thread-522.htm

漏洞简介

The Apache Spark UI offers the possibility to enable ACLs via theconfiguration option spark.acls.enable. With an authentication filter, thischecks whether a user has access permissions to view or modify theapplication. If ACLs are enabled, a code path in HttpSecurityFilter canallow someone to perform impersonation by providing an arbitrary user name.A malicious user might then be able to reach a permission check functionthat will ultimately build a Unix shell command based on their input, andexecute it. This will result in arbitrary shell command execution as theuser Spark is currently running as. This affects Apache Spark versions3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

　　‍

Apache Spark UI 提供了通过配置选项 spark.acls.enable。使用身份验证过滤器，这检查用户是否有访问权限来查看或修改应用。如果启用了 ACL，则 HttpSecurityFilter 中的代码路径可以允许某人通过提供任意用户名来执行模拟。然后恶意用户可能能够访问权限检查功能，最终将根据他们的输入构建一个 Unix shell 命令，并且执行它。这将导致任意 shell 命令执行。

影响版本：Apache Spark 版本 3.0.3 及更早版本，版本 3.11 至 3.1.2 ，以及版本 3.2.0 至 3.2.1

漏洞复现

　　下载 Apache Spark 3.2.1 https://archive.apache.org/dist/spark/

　　https://archive.apache.org/dist/spark/spark-3.2.1/spark-3.2.1-bin-hadoop2.7.tgz

　　根据描述是需要开启 acl 功能才可以触发漏洞

　　开启 ACL 可以通过设定启动时的参数 ./spark-shell --conf spark.acls.enable=true 或者在 conf/spark-defaults.conf 中添加 spark.acls.enable true

　　‍

　　构造 poc

http://localhost:4040/?doAs=\`[command injection here]`

漏洞分析

　　为了方便调试在启动脚本中添加上调试参数

export SPARK_SUBMIT_OPTS="-agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005"

　　输入错误的执行语句时的报错信息

　　漏洞的触发大概就在 org.apache.spark.security.ShellBasedGroupsMappingProvider.getUnixGroups

　　漏洞的调用栈应该为

org.apache.spark.ui.HttpSecurityFilter.doFilter(HttpSecurityFilter.scala:71)
org.apache.spark.SecurityManager.checkUIViewPermissions(SecurityManager.scala:238)
org.apache.spark.SecurityManager.isUserInACL(SecurityManager.scala:381)
org.apache.spark.util.Utils$.getCurrentUserGroups(Utils.scala:2523)
org.apache.spark.security.ShellBasedGroupsMappingProvider.getGroups(ShellBasedGroupsMappingProvider.scala:34)
org.apache.spark.security.ShellBasedGroupsMappingProvider.getUnixGroups(ShellBasedGroupsMappingProvider.scala:43)

　　加上断点进行调试分析

　　org.apache.spark.ui.HttpSecurityFilter#doFilter