PT-2022-2441 · Apache · Apache Hadoop

Jarlob + 1 · Published 2022-03-07 · Updated 2023-08-08 · CVE-2022-26612

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Hadoop versions prior to 3.2.3

Description The issue is related to the unTar function in Apache Hadoop, which uses the unTarUsingJava function on Windows and the built-in tar utility on Unix and other OSes. This can lead to a TAR entry creating a symlink under the expected extraction directory, pointing to an external directory. A subsequent TAR entry may then extract an arbitrary file into the external directory using the symlink name. On Windows, the getCanonicalPath call does not resolve symbolic links, bypassing the targetDirPath check and allowing writing outside the expected base directory.

Recommendations For Apache Hadoop versions prior to 3.2.3, update to Apache Hadoop 3.2.3 to address the issue. As a temporary workaround, consider restricting the use of the unTar function on Windows systems until the update is applied.

Exploit

Fix

Path traversal

Link Following

Weakness Enumeration

CWE-22

CWE-61

CWE-59

Related Identifiers

BDU:2022-02847

CVE-2022-26612

GHSA-GX2C-FVHC-PH4J

OESA-2022-2092

Affected Products

Apache Hadoop

References · 24

• 🔥 https://lists.apache.org/thread/hslo7wzw2449gv1jyjk8g6ttd7935fyz · Exploit
• https://bdu.fstec.ru/vul/2022-02847 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-37404 · Security Note
• https://osv.dev/vulnerability/OESA-2022-2092 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26612 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gx2c-fvhc-ph4j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-25168 · Security Note
• https://github.com/apache/hadoop · Note
• https://github.com/apache/hadoop/commits/rel/release-2.10.2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java · Note
• https://github.com/apache/hadoop/commits/rel/release-3.4.0/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java · Note
• https://github.com/apache/hadoop/commits/rel/release-3.2.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java · Note
• https://github.com/apache/hadoop/commits/rel/release-3.3.3/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java · Note
• https://github.com/apache/hadoop/blob/125e3b616040b4f98956aa946cc51e99f7d596c2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java#L964-L967 · Note
• https://github.com/apache/hadoop/blob/125e3b616040b4f98956aa946cc51e99f7d596c2/hadoop-common-project/hadoop-common/src/main/java/org/apache/hadoop/fs/FileUtil.java#L850 · Note