CVE-2020-9480
CRITICAL EXPLOITED IN THE WILD NUCLEIApache Spark <= 2.4.5 - Unauthenticated Remote Code Execution via Standalone Resource Manager
Title source: llmExploitation Summary
CVE-2020-9480 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including XiaoShaYu617. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-9480, targeting Apache Spark's pre-authentication remote code execution vulnerability. The exploit leverages the Spark REST API to submit a malicious job, executing arbitrary commands on the target system.
Description
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Exploits (1)
This repository contains a functional exploit for CVE-2020-9480, targeting Apache Spark's pre-authentication remote code execution vulnerability. The exploit leverages the Spark REST API to submit a malicious job, executing arbitrary commands on the target system.
Nuclei Templates (1)
port="6066" && banner="Spark Master"
References (6)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H