CVE-2017-9792 in Impala
Summary
by MITRE
In Apache Impala (incubating) before 2.10.0, a malicious user with "ALTER" permissions on an Impala table can access any other Kudu table data by altering the table properties to make it "external" and then changing the underlying table mapping to point to other Kudu tables. This violates and works around the authorization requirement that creating a Kudu external table via Impala requires an "ALL" privilege at the server scope. This privilege requirement for "CREATE" commands is enforced to precisely avoid this scenario where a malicious user can change the underlying Kudu table mapping. The fix is to enforce the same privilege requirement for "ALTER" commands that would make existing non-external Kudu tables external.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/15/2021
The vulnerability described in CVE-2017-9792 represents a critical authorization bypass flaw in Apache Impala version 2.9.0 and earlier, which allows malicious users to escalate their privileges and access unauthorized data through manipulation of table properties. This issue specifically affects the interaction between Impala and Kudu storage systems, where Impala acts as the query engine while Kudu provides the underlying storage layer. The flaw stems from an insufficient privilege check during ALTER operations on Kudu tables, creating a pathway for unauthorized data access that directly contradicts the intended security model of the system.
The technical implementation of this vulnerability exploits a fundamental weakness in the privilege validation mechanism within Impala's authorization framework. When a malicious user possesses ALTER permissions on a Kudu table, they can modify the table's properties to convert it from an internal table to an external table. This transformation allows the user to redirect the table mapping to point to completely different Kudu tables, effectively bypassing the normal access controls. The vulnerability operates through the manipulation of table metadata and underlying storage mappings, enabling unauthorized data exposure without proper authorization checks.
This security flaw directly violates the principle of least privilege and represents a classic case of privilege escalation through improper access control validation. The vulnerability works around the intended authorization model where creating external Kudu tables should require server-level "ALL" privileges to prevent unauthorized table mapping changes. The system's design assumes that external table creation requires elevated permissions, but the ALTER command fails to enforce the same security checks that protect the CREATE operation. This inconsistency creates a security gap that malicious users can exploit to gain access to data they should not be authorized to view.
The operational impact of this vulnerability is significant, as it allows unauthorized data access across different Kudu tables within the same cluster. Attackers can leverage this flaw to access sensitive information that should be restricted to authorized users only, potentially exposing confidential data, personal information, or proprietary business data. The vulnerability affects the integrity and confidentiality of the data processing environment, as it undermines the authorization controls that are fundamental to database security. Organizations using Impala with Kudu storage are at risk of data breaches and unauthorized information disclosure.
The mitigation strategy for CVE-2017-9792 involves implementing consistent privilege requirements for both CREATE and ALTER operations on Kudu tables within Impala. The fix requires enforcing the same server-level "ALL" privilege requirement during ALTER commands that would convert existing non-external Kudu tables into external tables. This approach aligns with the security principle that operations which can fundamentally alter table access patterns should require the same level of authorization as the initial creation operations. The solution essentially closes the authorization gap by ensuring that any operation that changes table mapping or access patterns requires the appropriate elevated privileges. This vulnerability classification aligns with CWE-284, which deals with inadequate access control, and maps to ATT&CK technique T1078 for valid accounts and privilege escalation, as it allows attackers to bypass access controls through legitimate administrative operations. Organizations should upgrade to Impala version 2.10.0 or later to receive the patched authorization enforcement mechanism, and should also review existing table permissions to ensure that only trusted users have ALTER privileges on Kudu tables.