CVE-2020-9480 Improper Authentication in Apache Spark
Attackers can bypass authentication in Apache Spark standalone mode to execute arbitrary shell commands on the host machine.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-9480?
CVE-2020-9480 is a critical authentication bypass vulnerability in Oracle Business Intelligence, published on 23 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).
Weakness: CWE-306
Which versions are affected by CVE-2020-9480?
6 open source packages ship an affected version, including pyspark, spark and org.apache.spark:spark-parent_2.11. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
pyspark PyPI | All versions | 2.4.6 |
pyspark PyPI | All versions | 2.4.6 |
pyspark PyPI | All versions | 2.4.6 |
spark Bitnami | All versions | 2.4.6 |
org.apache.spark:spark-parent_2.11 Maven | All versions | 2.4.6 |
org.apache.spark:spark-parent_2.11 Maven | All versions | 2.4.6 |
Products include Apache Spark, Oracle Business Intelligence.
How do I fix CVE-2020-9480?
Upgrade pyspark to 2.4.6 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-9480 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-9480 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Oracle Business Intelligence
Sources
Also known as BIT-spark-2020-9480, GHSA-wgx7-jwwm-cgjv, PYSEC-2020-95.