PRIOn Logo

CVE-2018-11770 Authentication flaw

Significant
Remediate Within one Month

CVE Information

Original CVE data

Published:
Updated:

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.

CWE: CWE-287
CVSS v24.9
AV:N/AC:M/AU:S/C:P/I:P/A:N
CVSS v34.2
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
References
https://spark.apache.org/security.html
http://www.securityfocus.com/bid/105097
https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E
Affected Vendors

Apache - (1)

Basic Analysis

Common vulnerability metrics

Vulnerabilty type as detected by PRIOnengine

Authentication flaw

CVSS Scores as calculated by PRIOnengine
CVSS v25.5
AV:N/AC:L/AU:S/C:P/I:P/A:N
CVSS v37.5
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
MITRE CWE Top 25

Vulnerability weakness type is in the top 25 CWEs according to MITRE. View Mitre Top 25 CWEs

Exploits

Exploits are available either through exploit packs, Github repos or the world wide web in general.

Active Exploitation

Vulnerability is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. See the KEV Catalog

Social Network Activity

-

Threat Actor Activity

No sightings of the vulnerability within threat reports.

Cybersecurity Frameworks

How the vulnerability maps against various cybersecurity frameworks

T1550.001 - Use Alternate Authentication Material (Application Access Token)
T1133 - External Remote Services

Compliance Impact

How the submited vulnerability affects compliance

-

Web Application Security Frameworks

Applicable if the issue likely affects a web application

WASC-19 - SQL Injection