Apache Hive up to 3.x Signed Cookie information exposure

Summaryinfo

A vulnerability was found in Apache Hive up to 3.x. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Signed Cookie Handler. Performing a manipulation results in information exposure. This vulnerability is identified as CVE-2024-23945. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Apache Hive up to 3.x. This affects an unknown function of the component Signed Cookie Handler. The manipulation with an unknown input leads to a information exposure vulnerability. CWE is classifying the issue as CWE-209. The product generates an error message that includes sensitive information about its environment, users, or associated data. This is going to have an impact on confidentiality. The summary by CVE is:

Signing cookies is an application security feature that adds a digital signature to cookie data to verify its authenticity and integrity. The signature helps prevent malicious actors from modifying the cookie value, which can lead to security vulnerabilities and exploitation. Apache Hive’s service component accidentally exposes the signed cookie to the end user when there is a mismatch in signature between the current and expected cookie. Exposing the correct cookie signature can lead to further exploitation. The vulnerable CookieSigner logic was introduced in Apache Hive by HIVE-9710 (1.2.0) and in Apache Spark by SPARK-14987 (2.0.0). The affected components are the following: * org.apache.hive:hive-service * org.apache.spark:spark-hive-thriftserver_2.11 * org.apache.spark:spark-hive-thriftserver_2.12

It is possible to read the advisory at lists.apache.org. This vulnerability is uniquely identified as CVE-2024-23945 since 01/24/2024. The exploitability is told to be easy. It is possible to initiate the attack remotely. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading to version 4.0.0 eliminates this vulnerability. Applying the patch 7638cb1a3b07713cc490aa2909a37037f89e08b4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Apache

Name

• Hive

Version

• 3.x

License

• open-source

Website

• Vendor: https://www.apache.org/
• Product: https://github.com/apache/hive/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion