CVE Series: Apache Spark (CVE-2022-33891)
|
Apache Spark is the biggest open-source project used for large-scale data processing and machine learning. Companies love it for its fast speed and ease of use. But a security flaw allows an adversary to just add a shell command to the URI to perform an arbitrary shell command execution. Exploit this flaw today using two attack vectors!
Course Description
This course is for seasoned red teamers, penetration testers, security and vulnerability assessment analysts, and system administrators who want to know how to exploit and protect against the latest vulnerabilities impacting enterprise systems.
Before taking this course, we recommend that you have a functional knowledge of web applications, Python scripting, and basic Unix commands. We also recommend taking our OWASP Top 10 course on Injection: https://www.cybrary.it/course/owasp-a1-injection/
What makes this vulnerability so dangerous is that an adversary can simply add a shell command to the URI and perform arbitrary shell command execution as a different user who appears “friendly.” It is imperative that defenders act quickly to patch their servers and determine if any malicious actors exploited this vulnerability.
By the end of this course, you should be able to:
Your instructor, Clint Kehr, is a technical manager for a financial services company’s Responsible Disclosure Team, where he interacts with ethical hackers who find vulnerabilities in the company’s infrastructure. Clint is a former Special Agent with the Department of Justice, where he specialized in internet investigations and conducted numerous cases on cyber threat actors on the surface, deep, and dark web, resulting in Clint earning the Attorney General’s Distinguished Service Award.
What are the prerequisites for this course?
Define the vulnerability, describe its root cause, and communicate its significance to key organizational stakeholders.
Exploit this vulnerability using publicly available exploit code.
Your instructor, Clint Kehr, is a technical manager for a financial services company’s Responsible Disclosure Team, where he interacts with ethical hackers who find vulnerabilities in the company’s infrastructure. Clint is a former Special Agent with the Department of Justice, where he specialized in internet investigations and conducted numerous cases on cyber threat actors on the surface, deep, and dark web, resulting in Clint earning the Attorney General’s Distinguished Service Award.
Module 1: The Apache Spark Vulnerability
User Reviews
Be the first to review “CVE Series: Apache Spark (CVE-2022-33891)”
You must be logged in to post a review.
There are no reviews yet.