Apache Spark Shell Command Injection Attempt in Web Server Logs (?doAs=`)

Alerts on web requests containing "?doAs=`" that may indicate Spark shell command injection attempts.

FreeUnreviewedSigmahighv1

apache-spark-shell-command-injection-attempt-in-web-server-logs-doas-1a9a04fd

title: Apache Spark Shell Command Injection Attempt in Web Server Logs (?doAs=`)
id: d01b63b4-5f54-4e05-be94-ab9935899a5f
status: test
description: This rule flags webserver log entries whose URL query string contains the pattern "?doAs=`", indicating a likely attempt to inject a command through the Spark shell doAs parameter. Such injection attempts matter because they may be used to execute attacker-controlled commands within a vulnerable Spark environment. The detection relies on webserver telemetry capturing the full request URI query string and checks for a specific suspicious character sequence in that field.
references:
  - https://github.com/W01fh4cker/cve-2022-33891/blob/fd973b56e78bca8822caa3a2e3cf1b5aff5d0950/cve_2022_33891_poc.py
  - https://sumsec.me/2022/CVE-2022-33891%20Apache%20Spark%20shell%20command%20injection.html
  - https://github.com/apache/spark/pull/36315/files
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/Exploits/CVE-2022-33891/web_cve_2022_33891_spark_shell_command_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-07-19
modified: 2023-01-02
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2022-33891
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection:
    cs-uri-query|contains: ?doAs=`
  condition: selection
falsepositives:
  - Web vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: 1a9a04fd-02d1-465c-abad-d733fd409f9c
    type: derived

What it detects

This rule flags webserver log entries whose URL query string contains the pattern "?doAs=`", indicating a likely attempt to inject a command through the Spark shell doAs parameter. Such injection attempts matter because they may be used to execute attacker-controlled commands within a vulnerable Spark environment. The detection relies on webserver telemetry capturing the full request URI query string and checks for a specific suspicious character sequence in that field.

Known false positives

Web vulnerability scanners

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.