[SPARK-38631] Arbitrary shell command injection via Utils.unpack()

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 3.1.2, 3.2.1, 3.3.0
• Fix Version/s: 3.1.3, 3.3.0, 3.2.2
• Component/s: Spark Core
• Target Version/s: 3.1.2, 3.2.1, 3.3.0
• Assignee: Hyukjin Kwon
• Reporter: Hyukjin Kwon
• Created: 23/Mar/22 03:53
• Updated: 12/Dec/22 18:11
• Resolved: 24/Mar/22 03:15

Description

There is a risk for arbitrary shell command injection via Utils.unpack when the filename is controlled by a malicious user. This is due to an issue in Hadoop's unTar, that is not properly escaping the filename before passing to a shell command:https://github.com/apache/hadoop/blob/trunk/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java#L904

Issue Links

• links to: [Github] Pull Request #35946 (HyukjinKwon)
• links to: [Github] Pull Request #35946 (HyukjinKwon)