cvelistv5 - cve-2018-11770

cve-2018-11770

Vulnerability from cvelistv5

Published

2018-08-13 00:00

Modified

2024-08-05 08:17

Severity ?

Summary

From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.

References

URL	Tags
security@apache.org	http://www.securityfocus.com/bid/105097	Broken Link, Third Party Advisory, VDB Entry
security@apache.org	https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E	Mailing List, Third Party Advisory
security@apache.org	https://spark.apache.org/security.html#CVE-2018-11770	Exploit, Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/105097	Broken Link, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108	https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E	Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://spark.apache.org/security.html#CVE-2018-11770	Exploit, Mitigation, Vendor Advisory

Impacted products

Vendor

Product

Version

▼

Apache Software Foundation

Apache Spark

Version: 1.3.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T08:17:09.223Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://spark.apache.org/security.html#CVE-2018-11770"
          },
          {
            "name": "[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E"
          },
          {
            "name": "105097",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105097"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Apache Spark",
          "vendor": "Apache Software Foundation",
          "versions": [
            {
              "lessThan": "2.4.0",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "maven"
            }
          ]
        }
      ],
      "datePublic": "2018-08-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "From version 1.3.0 onward, Apache Spark\u0027s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property \u0027spark.authenticate.secret\u0027 establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting \u0027spark.authenticate.secret\u0027 when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of \u0027spark.master.rest.enabled\u0027 to \u0027false\u0027."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-11-22T10:26:39.838Z",
        "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
        "shortName": "apache"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://spark.apache.org/security.html#CVE-2018-11770"
        },
        {
          "name": "[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E"
        },
        {
          "name": "105097",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105097"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@apache.org",
          "DATE_PUBLIC": "2018-08-13T00:00:00",
          "ID": "CVE-2018-11770",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Apache Spark",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "1.3.0 and later"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Apache Software Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "From version 1.3.0 onward, Apache Spark\u0027s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property \u0027spark.authenticate.secret\u0027 establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting \u0027spark.authenticate.secret\u0027 when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of \u0027spark.master.rest.enabled\u0027 to \u0027false\u0027."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://spark.apache.org/security.html#CVE-2018-11770",
              "refsource": "CONFIRM",
              "url": "https://spark.apache.org/security.html#CVE-2018-11770"
            },
            {
              "name": "[dev] 20180813 CVE-2018-11770: Apache Spark standalone master, Mesos REST APIs not controlled by authentication",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485@%3Cdev.spark.apache.org%3E"
            },
            {
              "name": "105097",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105097"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
    "assignerShortName": "apache",
    "cveId": "CVE-2018-11770",
    "datePublished": "2018-08-13T00:00:00",
    "dateReserved": "2018-06-05T00:00:00",
    "dateUpdated": "2024-08-05T08:17:09.223Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2018-11770\",\"sourceIdentifier\":\"security@apache.org\",\"published\":\"2018-08-13T16:29:00.650\",\"lastModified\":\"2024-11-21T03:43:59.817\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"From version 1.3.0 onward, Apache Spark\u0027s standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property \u0027spark.authenticate.secret\u0027 establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting \u0027spark.authenticate.secret\u0027 when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of \u0027spark.master.rest.enabled\u0027 to \u0027false\u0027.\"},{\"lang\":\"es\",\"value\":\"A partir de la versi\u00f3n 1.3.0, el maestro standalone de Apache Spark expone una API REST para el env\u00edo de trabajos, adem\u00e1s del mecanismo de env\u00edo utilizado por spark-submit. En modo standalone, la propiedad config \u0027spark.authenticate.secret\u0027 establece un secreto compartido para autenticar las solicitudes de env\u00edo de trabajos a trav\u00e9s de spark-submit. Sin embargo, la API REST no utiliza ni este ni ning\u00fan otro mecanismo de autenticaci\u00f3n, y esto no est\u00e1 adecuadamente documentado. En este caso, un usuario podr\u00eda ejecutar un programa de controlador sin autenticar, pero no lanzar ejecutores utilizando la API REST. Esta API REST tambi\u00e9n es utilizada por Mesos, cuando est\u00e1 configurada para ejecutarse en modo cluster (es decir, cuando tambi\u00e9n se ejecuta MesosClusterDispatcher), para el env\u00edo de trabajos. Las versiones futuras de Spark mejorar\u00e1n la documentaci\u00f3n sobre estos puntos y prohibir\u00e1n establecer \\\"spark.authenticate.secret\\\" cuando se ejecuten las API REST para dejar esto claro. Las versiones futuras tambi\u00e9n desactivar\u00e1n la API REST de forma predeterminada en el maestro standalone cambiando el valor predeterminado de \\\"spark.master.rest.enabled\\\" a \\\"false\\\".\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N\",\"baseScore\":4.2,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":2.5}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:P/A:N\",\"baseScore\":4.9,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.8,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:spark:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3.0\",\"versionEndExcluding\":\"2.4.0\",\"matchCriteriaId\":\"4D04790B-958F-4EB3-A394-E2CDD09CB458\"}]}]}],\"references\":[{\"url\":\"http://www.securityfocus.com/bid/105097\",\"source\":\"security@apache.org\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E\",\"source\":\"security@apache.org\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://spark.apache.org/security.html#CVE-2018-11770\",\"source\":\"security@apache.org\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/105097\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://lists.apache.org/thread.html/bd8e51314041451a2acd720e9223fc1c15a263ccacb396a75b1fc485%40%3Cdev.spark.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://spark.apache.org/security.html#CVE-2018-11770\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}"
  }
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

cve-2018-11770

Vulnerability from cvelistv5

ghsa-w4r4-65mg-45x2

Vulnerability from github

gsd-2018-11770

Vulnerability from gsd

Tags

Sightings

Nomenclature