# CVE-2018-11770: org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11 Improper Authentication vulnerability > Unauthenticated users can submit jobs via the REST API in Apache Spark standalone mode, potentially executing arbitrary code. - **Severity:** Medium 4.2 (`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 13 Aug 2018 - **Updated:** 5 Aug 2024 - **Also known as:** GHSA-w4r4-65mg-45x2 ## What is CVE-2018-11770? CVE-2018-11770 is a medium-severity missing authorization vulnerability in Apache Spark, published on 13 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'. Weakness: CWE-287 (Improper Authentication) ## Which versions are affected by CVE-2018-11770? 4 open source packages ship an affected version, including org.apache.spark:spark-core_2.10 and org.apache.spark:spark-core_2.11. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `org.apache.spark:spark-core_2.10` | Maven | From 1.0.0 to 2.2.2 | None | | `org.apache.spark:spark-core_2.10` | Maven | From 1.0.0 to 2.2.2 | None | | `org.apache.spark:spark-core_2.11` | Maven | From 1.0.0 to 2.3.2 | None | | `org.apache.spark:spark-core_2.11` | Maven | From 1.0.0 to 2.3.2 | None | Products: Apache Spark. ## How do I fix CVE-2018-11770? No fix has been published for CVE-2018-11770 yet. Limit exposure of the affected software until one is available. ## Is CVE-2018-11770 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-11770 exists. Public exploit code: - Python RCE exploit for Apache Spark rewritten from Metasploit module (github_poc): https://github.com/ivanitlearning/CVE-2018-11770 - Apache Spark Unauthenticated Command Execution (metasploit) ## Other vulnerabilities in Apache Spark - [CVE-2022-33891](https://insights.sbomify.com/CVE-2022-33891/): Apache Spark Command Injection (high 8.8, exploited in the wild) - [CVE-2020-9480](https://insights.sbomify.com/CVE-2020-9480/): Improper Authentication in Apache Spark (critical 9.8) - [CVE-2018-17190](https://insights.sbomify.com/CVE-2018-17190/): Remote Code Execution in spark-core (critical 9.8) - [CVE-2019-20445](https://insights.sbomify.com/CVE-2019-20445/): HTTP Request Smuggling in Netty (critical 9.1) - [CVE-2025-54920](https://insights.sbomify.com/CVE-2025-54920/): Apache Spark: Spark History Server Code Execution Vulnerability (high 8.8) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2018-11770 and fix it if it is affected. What it is: CVE-2018-11770 is a medium-severity missing authorization vulnerability in Apache Spark, published on 13 Aug 2018. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-11770 exists. Affected packages and fixed versions: - org.apache.spark:spark-core_2.10 (Maven): affected from 1.0.0 up to 2.2.2; no fix listed - org.apache.spark:spark-core_2.10 (Maven): affected from 1.0.0 up to 2.2.2; no fix listed - org.apache.spark:spark-core_2.11 (Maven): affected from 1.0.0 up to 2.3.2; no fix listed - org.apache.spark:spark-core_2.11 (Maven): affected from 1.0.0 up to 2.3.2; no fix listed Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2018-11770/ (Markdown: https://insights.sbomify.com/CVE-2018-11770/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2018-11770 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2018-11770 - OSV: https://osv.dev/vulnerability/CVE-2018-11770 --- From sbomify Insights: https://insights.sbomify.com/CVE-2018-11770/ Summaries are generated and may contain mistakes; the official description above is the record.