Apache Spark Command Injection (CVE‑2022‑33891) – UI ACL Bypass Risk
What It Is – Apache Spark (all versions prior to the 3.3.2 patch) contains a command‑injection flaw in the Spark UI when Access Control Lists (ACLs) are enabled. An attacker who can reach the UI can inject arbitrary shell commands that Spark will execute on the host.
Exploitability – No public exploit has been observed, but a proof‑of‑concept exists and the CVSS v3.1 base score is 8.8 (High).
Affected Products – Apache Spark (open‑source data‑processing engine) – any deployment where the UI is exposed and ACLs are turned on.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – The flaw shows how insufficient hardening of UI endpoints can undermine the “least‑privilege” control objective that underpins many frameworks (e.g., NIST CSF 2.0 Protect).
- Continuous evidence – Detecting and proving that UI ACLs are correctly configured and that no unauthorized command execution occurs requires ongoing log collection and audit‑ready evidence.
- Enterprise buyer expectations – Large customers now demand demonstrable controls (configuration baselines, monitoring, remediation proof) before they trust a data‑processing platform.
Recommended Actions
- Apply the Apache Spark 3.3.2 (or later) security patch that resolves CVE‑2022‑33891.
- If the UI must remain exposed, enforce strict, role‑based ACLs and disable unnecessary UI functions.
- Enable comprehensive logging of UI access and command‑execution events; forward logs to a SIEM for real‑time alerting.
- Map this finding to the “Access Control & Secure Configuration” control objective in your chosen framework and capture remediation evidence in a Trust Center.
Source: CISA KEV – CVE‑2022‑33891