CVE-2023-22946 Apache Spark proxy-user privilege escalation from malicious configuration class

What is CVE-2023-22946?

CVE-2023-22946 is a medium-severity vulnerability in Apache Spark, published on 17 Apr 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Update to Apache Spark 3.4.0 or later, and ensure that spark.submit.proxyUser.allowCustomClasspathInClusterMode is set to its default of "false", and is not overridden by submitted applications.

Weakness: CWE-269

Which versions are affected by CVE-2023-22946?

8 open source packages ship an affected version, including org.apache.spark:spark-core_2.12, spark and org.apache.spark:spark-core_2.13. It affects 1 product.

Products include Apache Spark.

How do I fix CVE-2023-22946?

Upgrade org.apache.spark:spark-core_2.12 to 3.3.3 or later.

Is CVE-2023-22946 being exploited?

There is no known exploitation of CVE-2023-22946 in the wild and no public exploit code.

Other vulnerabilities in Apache Spark

• CVE-2022-33891 Apache Spark Command Injection Exploited High 8.8
• CVE-2020-9480 Improper Authentication in Apache Spark Critical 9.8
• CVE-2018-17190 Remote Code Execution in spark-core Critical 9.8
• CVE-2019-20445 HTTP Request Smuggling in Netty Critical 9.1
• CVE-2025-54920 Apache Spark: Spark History Server Code Execution Vulnerability High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-spark-2023-22946, GHSA-329j-jfvr-rhr6, PYSEC-2023-44.