Auth bypass in Apache Spark
CVE-2020-9480
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Vulnerability class: Broken Authentication
EPSS: 0.294 (98.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Apache Spark
- Apache Software Foundation Spark — versions Apache Spark 2.4.5 and earlier
- Oracle Business_intelligence — versions 5.5.0.0.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (x_refsource_CONFIRM, Vendor Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (Patch, Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-9480?
- CVE-2020-9480 is a critical-severity vulnerability in Apache Spark, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2020-06-23.
- How severe is CVE-2020-9480?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2020-9480 known to be exploited?
- 7 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.