cnvd - cnvd-2018-15548

cnvd-2018-15548

Vulnerability from cnvd

Title: Apache Spark认证控制漏洞

Description:

Apache Spark是美国阿帕奇（Apache）软件基金会的的一款支持非循环数据流和内存计算的大规模数据处理引擎。

Apache Spark 1.3.0及之后版本中存在安全漏洞，该漏洞源于standalone master或启用集群模式的Mesos master不仅公开了提交机制还公开了用于提交工作的REST API。攻击者可利用该漏洞未经身份验证运行驱动程序。

Severity: 中

Formal description:

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： https://spark.apache.org/

Reference: https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485@%3Cdev.spark.apache.org%3E https://spark.apache.org/security.html#CVE-2018-11770

Impacted products

Name
Apache Spark >=1.3.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-11770"
    }
  },
  "description": "Apache Spark\u662f\u7f8e\u56fd\u963f\u5e15\u5947\uff08Apache\uff09\u8f6f\u4ef6\u57fa\u91d1\u4f1a\u7684\u7684\u4e00\u6b3e\u652f\u6301\u975e\u5faa\u73af\u6570\u636e\u6d41\u548c\u5185\u5b58\u8ba1\u7b97\u7684\u5927\u89c4\u6a21\u6570\u636e\u5904\u7406\u5f15\u64ce\u3002\r\n\r\nApache Spark 1.3.0\u53ca\u4e4b\u540e\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8estandalone master\u6216\u542f\u7528\u96c6\u7fa4\u6a21\u5f0f\u7684Mesos master\u4e0d\u4ec5\u516c\u5f00\u4e86\u63d0\u4ea4\u673a\u5236\u8fd8\u516c\u5f00\u4e86\u7528\u4e8e\u63d0\u4ea4\u5de5\u4f5c\u7684REST API\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u8fd0\u884c\u9a71\u52a8\u7a0b\u5e8f\u3002",
  "discovererName": "Imran Rashid, Cloudera,Fengwei Zhang, Alibaba Cloud Security Team",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttps://spark.apache.org/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-15548",
  "openTime": "2018-08-17",
  "products": {
    "product": "Apache Spark \u003e=1.3.0"
  },
  "referenceLink": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485@%3Cdev.spark.apache.org%3E\r\nhttps://spark.apache.org/security.html#CVE-2018-11770",
  "serverity": "\u4e2d",
  "submitTime": "2018-08-15",
  "title": "Apache Spark\u8ba4\u8bc1\u63a7\u5236\u6f0f\u6d1e"
}

CVE-2018-11770 (GCVE-0-2018-11770)

Vulnerability from cvelistv5

Published

2018-08-13 00:00

Modified

2024-08-05 08:17

Severity ?

CWE

Improper Access Control

Summary

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.

References

▼	URL	Tags
	https://spark.apache.org/security.html#CVE-2018-11770	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/105097	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	Apache Software Foundation	Apache Spark	Version: 1.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:17:09.223Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://spark.apache.org/security.html#CVE-2018-11770"
          },
          {
            "name": "[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E"
          },
          {
            "name": "105097",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105097"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Spark",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "datePublic": "2018-08-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "From version 1.3.0 onward, Apache Spark\u0027s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property \u0027spark.authenticate.secret\u0027 establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting \u0027spark.authenticate.secret\u0027 when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of \u0027spark.master.rest.enabled\u0027 to \u0027false\u0027."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-22T10:26:39.838Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://spark.apache.org/security.html#CVE-2018-11770"
        },
        {
          "name": "[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E"
        },
        {
          "name": "105097",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105097"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2018-08-13T00:00:00",
          "ID": "CVE-2018-11770",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Spark",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.3.0 and later"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "From version 1.3.0 onward, Apache Spark\u0027s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property \u0027spark.authenticate.secret\u0027 establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting \u0027spark.authenticate.secret\u0027 when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of \u0027spark.master.rest.enabled\u0027 to \u0027false\u0027."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://spark.apache.org/security.html#CVE-2018-11770",
              "refsource": "CONFIRM",
              "url": "https://spark.apache.org/security.html#CVE-2018-11770"
            },
            {
              "name": "[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485@%3Cdev.spark.apache.org%3E"
            },
            {
              "name": "105097",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105097"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2018-11770",
    "datePublished": "2018-08-13T00:00:00",
    "dateReserved": "2018-06-05T00:00:00",
    "dateUpdated": "2024-08-05T08:17:09.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted