CVE-2025-60012: 
Java vulnerability analysis and mitigation

CVE-2025-60012 is an improper input validation vulnerability in Apache Livy that allows authenticated users to gain unauthorized access to files via malicious Spark configuration values. It affects Apache Livy versions 0.7.0 and 0.8.0 (specifically 0.7.0-incubating through 0.9.0-incubating) when connecting to Apache Spark 3.1 or later. The vulnerability was discovered by Furue Hideyuki and publicly disclosed on March 12, 2026 via the oss-security mailing list. It carries a CVSS v3.1 base score of 6.3 (Medium) (Feedly, oss-security).

The root cause is improper input validation (CWE-20) in how Apache Livy processes Spark configuration parameters submitted via its REST or JDBC interface. Starting with Apache Spark 3.1, certain new configuration keys were introduced that Livy failed to adequately restrict, allowing an authenticated user to supply arbitrary Spark configuration values — including path-related parameters — that can be leveraged for path traversal-style file access (e.g., payloads like /opt/safe-data/../../../etc/passwd). Exploitation requires the attacker to have valid access to Livy's REST or JDBC interface and the ability to submit arbitrary Spark configuration values in their requests. A proof-of-concept repository with code diffs and conceptual attack examples is publicly available (oss-security, PoC GitHub).

Successful exploitation allows authenticated users to read and potentially modify files on the underlying system that they are not authorized to access, resulting in unauthorized file disclosure and potential data integrity compromise. The vulnerability's scope is limited to the affected Livy server host and its accessible file system, but sensitive files such as configuration files, credentials, or data files processed by Spark could be exposed. Confidentiality, integrity, and availability impacts are each rated Low per the CVSS assessment, reflecting the authenticated nature of the attack and the bounded scope (Feedly, oss-security).

1. Reconnaissance: Identify Apache Livy instances (versions 0.7.0 or 0.8.0) connected to Apache Spark 3.1 or later, exposed via REST (typically port 8998) or JDBC interfaces, using network scanning tools or service discovery.
2. Authenticate: Obtain valid credentials or a session token for the Apache Livy REST or JDBC interface — exploitation requires authenticated access.
3. Craft malicious request: Construct a Livy REST API request (e.g., a POST to /sessions or /batches) that includes a Spark configuration parameter introduced in Spark 3.1 with a path traversal payload as its value (e.g., "conf": {"spark.some.config.key": "/opt/safe-data/../../../etc/passwd"}).
4. Submit request: Send the crafted request to the Livy REST endpoint. Livy passes the unsanitized configuration value to Spark without adequate validation.
5. Access unauthorized files: The Spark job or session processes the malicious configuration, causing the server to read or expose the targeted file, which the attacker retrieves from the job output or logs (PoC GitHub, oss-security).

• Network: Unusual or repeated POST requests to Livy REST endpoints (/sessions, /batches) from unexpected source IPs, particularly containing Spark configuration keys introduced in Spark 3.1.
• Logs: Livy server logs showing requests with Spark configuration values containing path traversal sequences (e.g., ../, %2e%2e%2f) or references to sensitive system paths (e.g., /etc/passwd, /etc/shadow).
• Process: Spark executor processes accessing files outside expected data directories, or unusual file read activity by the Livy/Spark service account on the host.
• File System: Evidence of access to sensitive files (e.g., /etc/passwd, credential files, configuration files) by the Livy or Spark process user in OS audit logs (PoC GitHub).

The Apache Software Foundation has released Apache Livy 0.9.0, which fixes this vulnerability; users are strongly recommended to upgrade from affected versions 0.7.0 and 0.8.0 (oss-security). For organizations unable to patch immediately, restrict access to Apache Livy's REST (port 8998) and JDBC interfaces to trusted users and networks using firewall rules or network segmentation. Additionally, implement strict input validation or allowlisting controls on Spark configuration parameters accepted by Livy, and monitor for suspicious requests containing unusual configuration values.

The vulnerability was announced on the oss-security mailing list and the Apache announcements list, with brief coverage on security news sites such as SecurityOnline.info, which noted it as part of a broader set of Apache Livy patches addressing path traversal and file access flaws (SecurityOnline). Community reaction has been limited, consistent with the Medium severity rating and the authenticated-only exploitation requirement. No significant vendor statements beyond the official Apache advisory or notable researcher commentary beyond the PoC repository have been identified.