[jira] [Commented] (SPARK-50240) Command Execution Vulnerability in Spark (JavaOptions)

["Sean R. Owen (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SPARK-50240?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17900497#comment-17900497 ] 

Sean R. Owen commented on SPARK-50240:
--------------------------------------

We had already discussed this on the mailing list. This is not considered a vulnerability, as it doesn't let you do anything you can't do in a Spark application. The problem is specific to your deployment, and you can sanitize this in your specific application.

However if there is a reliable and simple sanitation for this that doesn't prohibit valid flags, it's probably fine to add. This isn't something that users _need_ to be able to do of course.

> Command Execution Vulnerability in Spark (JavaOptions)
> ------------------------------------------------------
>
>                 Key: SPARK-50240
>                 URL: https://issues.apache.org/jira/browse/SPARK-50240
>             Project: Spark
>          Issue Type: Bug
>          Components: Spark Submit
>    Affects Versions: 3.5.1
>            Reporter: Xiaotong
>            Priority: Critical
>
> We found that Spark allow user to upload jar packet with`extraJavaOptions` ,
>  
> When instantiating a JAR package, use the javaOption configuration construct to execute the command if you configure the advanced optional parameters:
> {color:#808080}spark.executor.extraJavaOption:{color}
> {code:java}
> \'touch\$IFS/tmp/zzz123|'{code}
> The instance executes the jar package, uses the Yarn mode, and injects 'touch /tmp/zzz123' into the bash -c execution command.
> Command as:
> {code:java}
> spark-submit --class JavaWordCount --master yarn --deploy-mode client --conf spark.executor.extraJavaOptions="\`touch\$IFS/tmp/zzz123\`" test.jar {code}
> for java:
> {code:java}
> sparkLauncher.setConf("spark.executor.extraJavaOptions", "`touch$IFS/tmp/zzz123`"); {code}
> Spark execution location:
> /yarn/src/main/scala/org/apache/spark/deploy/yarn/ExecutorRunnable.scala
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org