Apache Hadoop up to 2.10.1/3.2.3/3.3.2 API FileUtil.unTar argument injection

Summaryinfo

A vulnerability was found in Apache Hadoop up to 2.10.1/3.2.3/3.3.2. It has been rated as critical. Affected is the function FileUtil.unTar of the component API. Performing a manipulation results in argument injection. This vulnerability is identified as CVE-2022-25168. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Apache Hadoop up to 2.10.1/3.2.3/3.3.2 (Network Management Software). It has been classified as critical. This affects the function FileUtil.unTar of the component API. The manipulation with an unknown input leads to a argument injection vulnerability. CWE is classifying the issue as CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).

The weakness was released 08/05/2022. It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2022-25168 since 02/15/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 2.10.2, 3.2.4 or 3.3.3 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Apache

Name

• Hadoop

Version

• 2.10.0
• 2.10.1
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3
• 3.3.0
• 3.3.1
• 3.3.2

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion