CVE-2022-25168

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

CVSS v3.0 9.8 CRITICAL

9.8^/10

CVSS v3.0 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130	Mailing List Vendor Advisory
https://security.netapp.com/advisory/ntap-20220915-0007/

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:apache:hadoop::::::::
	cpe:2.3:a:apache:hadoop::::::::
	cpe:2.3:a:apache:hadoop::::::::

Information

Published : 2022-08-04 08:15

Updated : 2022-09-15 11:15

NVD link : CVE-2022-25168

Mitre link : CVE-2022-25168

JSON object : View

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Advertisement

Products Affected

apache

hadoop

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130", "name": "https://lists.apache.org/thread/mxqnb39jfrwgs3j6phwvlrfq4mlox130", "tags": ["Mailing List", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://security.netapp.com/advisory/ntap-20220915-0007/", "name": "https://security.netapp.com/advisory/ntap-20220915-0007/", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. \"Check existence of file before untarring/zipping\", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136)."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-88"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-25168", "ASSIGNER": "security@apache.org"}}, "impact": {"baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}}, "publishedDate": "2022-08-04T15:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2.10.1", "versionStartIncluding": "2.0.0"}, {"cpe23Uri": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.3.2", "versionStartIncluding": "3.3.0"}, {"cpe23Uri": "cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "3.2.3", "versionStartIncluding": "3.0.0"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-09-15T18:15Z"}