[
https://issues.apache.org/jira/browse/SPARK-50240?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17900497#comment-17900497
]
Sean R. Owen commented on SPARK-50240:
--------------------------------------
We had already discussed this on the mailing list. This is not considered a
vulnerability, as it doesn't let you do anything you can't do in a Spark
application. The problem is specific to your deployment, and you can sanitize
this in your specific application.
However if there is a reliable and simple sanitation for this that doesn't
prohibit valid flags, it's probably fine to add. This isn't something that
users _need_ to be able to do of course.
> Command Execution Vulnerability in Spark (JavaOptions)
> ------------------------------------------------------
>
> Key: SPARK-50240
> URL: https://issues.apache.org/jira/browse/SPARK-50240
> Project: Spark
> Issue Type: Bug
> Components: Spark Submit
> Affects Versions: 3.5.1
> Reporter: Xiaotong
> Priority: Critical
>
> We found that Spark allow user to upload jar packet with`extraJavaOptions` ,
>
> When instantiating a JAR package, use the javaOption configuration construct
> to execute the command if you configure the advanced optional parameters:
> {color:#808080}spark.executor.extraJavaOption:{color}
> {code:java}
> \'touch\$IFS/tmp/zzz123|'{code}
> The instance executes the jar package, uses the Yarn mode, and injects 'touch
> /tmp/zzz123' into the bash -c execution command.
> Command as:
> {code:java}
> spark-submit --class JavaWordCount --master yarn --deploy-mode client --conf
> spark.executor.extraJavaOptions="\`touch\$IFS/tmp/zzz123\`" test.jar {code}
> for java:
> {code:java}
> sparkLauncher.setConf("spark.executor.extraJavaOptions",
> "`touch$IFS/tmp/zzz123`"); {code}
> Spark execution location:
> /yarn/src/main/scala/org/apache/spark/deploy/yarn/ExecutorRunnable.scala
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
