[SPARK-11682] Commons-collections object deserialization may expose remote command execution vulnerability

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Assignee: Unassigned
• Reporter: Ted Yu
• Created: 12/Nov/15 03:27
• Updated: 12/Nov/15 11:46
• Resolved: 12/Nov/15 11:46

Description

http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/

TL;DR: If you have commons-collections on your classpath and accept and process Java object serialization data, then you may have an exploitable remote command execution vulnerability.

In ./launcher/src/main/java/org/apache/spark/launcher/LauncherConnection.java :

      ObjectInputStream in = new ObjectInputStream(socket.getInputStream());
      while (!closed) {
        Message msg = (Message) in.readObject();

There may be other occurrence(s).

Issue Links

• duplicates: SPARK-11652 Remote code execution with InvokerTransformer