Cross-Site Scripting Vulnerability in Apache Spark by Apache

CVE-2017-7678

Summary

In vulnerable versions of Apache Spark prior to 2.2.0, an attacker may exploit user trust by tricking them into visiting a malicious link that targets a shared Spark cluster. This can lead to the submission of harmful content, potentially including MHTML scripts, to the Spark master or history server. Once submitted, this data is reflected back to the user, making it possible for MS Windows clients to inadvertently execute the script while interacting with Spark's web UIs. This highlights a serious user-centric attack vector where the integrity of the application is compromised through social engineering.

References