Apache Spark contains a critical deserialization vulnerability in its History Server that allows authenticated attackers to achieve remote code execution on the host system.

The Spark History Server utilizes insecure polymorphic deserialization with Jackson, specifically when processing event log files. An attacker with access to the event logs directory can inject malicious JSON payloads that instantiate arbitrary classes, such as JDBC connection objects, leading to command execution.

The ability to execute arbitrary commands on the host running the Spark History Server represents a total compromise of the affected node. This vulnerability carries a CVSS score of 8.8, reflecting the high risk of unauthorized system access, potential data exfiltration from the underlying infrastructure, and complete loss of integrity and availability for the affected Spark instance.

Immediate Action: Upgrade to Apache Spark version 3.5.7 or 4.0.1 immediately to resolve the deserialization flaw.

Proactive Monitoring: Monitor the Spark History Server logs and the event log storage directory for unauthorized file modifications or suspicious JSON payloads containing unexpected class references.

Compensating Controls: Restrict access to the Spark event log storage directory to only authorized service accounts and ensure the Spark History Server is isolated within a secure network segment.

Public Exploit Available: Unknown

Given the severity of this remote code execution vulnerability, organizations running Apache Spark must prioritize the transition to the patched versions, 3.5.7 or 4.0.1. Immediate patching is the only effective way to neutralize the risk posed by the insecure deserialization mechanism within the History Server.