github.com
https://github.com/advisories/GHSA-8cw6-5qvp-q3wj CVE-2018-8024
MEDIUMNuclei
Exposure of Sensitive Information to an Unauthorized Actor in Apache Spark via crafted URL
Record summary
CVE-2018-8024 has a selected CVSS score of 5.4 (medium); EIP currently links 1 curated repository PoC and 1 Nuclei template.
Description
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.
Description source: CVE List
Exploitation context
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Apache SparkBrowse Apache Software Foundation / Apache Spark | CVE List | 1.0.0 to 2.1.2 | affected |
| 2.2.0 to 2.2.1 | affected | ||
| 2.3.0 | affected | ||
org.apache.spark:spark-core_2.10Browse Maven / org.apache.spark:spark-core_2.10 | GitHub Advisory | 2.1.0 to < 2.1.3 · Fixed in 2.1.3 | affected |
| 2.2.0 to < 2.2.2 · Fixed in 2.2.2 | affected | ||
org.apache.spark:spark-core_2.11Browse Maven / org.apache.spark:spark-core_2.11 | GitHub Advisory | 2.1.0 to < 2.1.3 · Fixed in 2.1.3 | affected |
| 2.2.0 to < 2.2.2 · Fixed in 2.2.2 | affected | ||
| 2.3.0 | affected | ||
| 2.3.0 to < 2.3.1 · Fixed in 2.3.1 | affected |
Proofs of concept
1Curated repository PoCs
GitHubCVE-2018-8024Curated repository PoCby RhinoSecurityLabsStars: 905Not analyzed2 files
Nuclei templates
1ProjectDiscoveryMEDIUMApache Spark UI - Cross-Site ScriptingCVSS 6.1
Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint.
Impact
Attackers can execute arbitrary JavaScript in victims' browsers via crafted query string parameters, potentially stealing session cookies or performing actions on behalf of users.
Remediation
Upgrade to Apache Spark version 2.3.2 or later.
WeaknessesCWE-79
Authorsritikchaddha
Template tagscvecve2018sparkxssuivuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*
Shodan: title:"spark master at"
FOFA: title="spark master at"
https://github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2018-8024 https://nvd.nist.gov/vuln/detail/CVE-2018-8024
Source: ProjectDiscovery
References
5[dev] 20180711 CVE-2018-8024 Apache Spark XSS vulnerability in UImailing list
https://lists.apache.org/thread.html/5f241d2cda21cbcb3b63e46e474cf5f50cce66927f08399f4fab0aba%40%3Cdev.spark.apache.org%3E lists.apache.org
https://lists.apache.org/thread.html/5f241d2cda21cbcb3b63e46e474cf5f50cce66927f08399f4fab0aba@%3Cdev.spark.apache.org%3E nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-8024 spark.apache.orgConfirmation
https://spark.apache.org/security.html