QID 150680

Apache Spark is a multi-language engine for executing data engineering, data science, and machine learning on single-node machines or clusters.

In Apache Spark, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitting user, however, by providing malicious configuration-related classes on the classpath. This affects architectures relying on proxy-user, for example those using Apache Livy to manage submitted applications.

Affected Versions:
Apache Spark versions prior to 3.4.0

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request and checks the response body to confirm if the host is running vulnerable version of Apache Spark.

If the vulnerability is exploited, an attacker could potentially execute malicious code with the same privileges as the submitting user.