PT-2018-18389 · Mozilla+3 · Firefox+3
Spencer Gietzen
·
Published
2018-07-12
·
Updated
2019-03-14
·
CVE-2018-8024
CVSS v3.1
5.4
Medium
| Vector | AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
Apache Spark versions 2.1.0 through 2.1.2
Apache Spark versions 2.2.0 through 2.2.1
Apache Spark version 2.3.0
Description:
A malicious user can construct a URL pointing to a Spark cluster's UI's job and stage info pages. If a user is tricked into accessing the URL, it can be used to cause script to execute and expose information from the user's view of the Spark UI. Some browsers, like recent versions of Chrome and Safari, can block this type of attack, but current versions of Firefox (and possibly others) cannot.
Recommendations:
For Apache Spark versions 2.1.0 through 2.1.2, consider disabling access to the job and stage info pages in the Spark UI until a patch is available.
For Apache Spark versions 2.2.0 through 2.2.1, consider disabling access to the job and stage info pages in the Spark UI until a patch is available.
For Apache Spark version 2.3.0, consider disabling access to the job and stage info pages in the Spark UI until a patch is available.
As a temporary workaround, consider restricting access to the Spark UI to minimize the risk of exploitation.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Apache Spark
Google Chrome
Firefox
Safari