CVE-2018-8024
MEDIUM NUCLEIApache Spark 2.1.0-2.1.2, 2.2.0-2.2.1, 2.3.0 - Cross-Site Scripting via Job and Stage Info Pages
Title source: llmExploitation Summary
CVE-2018-8024 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.
Description
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL pointing to a Spark cluster's UI's job and stage info pages, and if a user can be tricked into accessing the URL, can be used to cause script to execute and expose information from the user's view of the Spark UI. While some browsers like recent versions of Chrome and Safari are able to block this type of attack, current versions of Firefox (and possibly others) do not.
Nuclei Templates (1)
Apache Spark UI - Cross-Site Scripting
MEDIUMVERIFIEDby ritikchaddha
Shodan:
title:"spark master at"
FOFA:
title="spark master at"
References (2)
Core 2
Core References
Mitigation, Vendor Advisory x_refsource_confirm
https://spark.apache.org/security.html#CVE-2018-8024
Mailing List mailing-list
x_refsource_mlist
https://lists.apache.org/thread.html/5f241d2cda21cbcb3b63e46e474cf5f50cce66927f08399f4fab0aba%40%3Cdev.spark.apache.org%3E
Scores
CVSS v3
5.4
EPSS
0.0554
EPSS Percentile
91.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-200
Status
published
Products (5)
apache/spark
2.3.0
apache/spark
2.1.0 - 2.1.2
mozilla/firefox
org.apache.spark/spark-core_2.10
2.1.0 - 2.1.3Maven
org.apache.spark/spark-core_2.11
2.1.0 - 2.1.3Maven
Published
Jul 12, 2018
Tracked Since
Feb 18, 2026