CVE-2024-23945 Impacts Apache Hive and Spark

Apache Hive and Apache Spark have been impacted by a vulnerability CVE-2024-23945 with a CVSS score of 8.7.This vulnerability specifically targets the CookieSigner component, which is crucial for signing cookies and ensuring their authenticity and integrity. The issue arises when there’s a mismatch in the cookie signature, leading to the exposure of the correct cookie signature to the end user. This exposure can pave the way for malicious exploitation.

Technical Details:

• Affected Components:
  • Apache Hive: org.apache.hive:hive-service
  • Apache Spark: org.apache.spark:spark-hive-thriftserver_2.11 and org.apache.spark:spark-hive-thriftserver_2.12
• Vulnerable Versions:
  • Apache Hive: Versions 1.2.0 before 4.0.0
  • Apache Spark: Versions 2.0.0 before 3.0.0, 3.0.0 before 3.3.4, 3.4.0 before 3.4.2, and 3.5.0

Exploitation Mechanism:

The root of this vulnerability lies in the CookieSigner component’s logic. When a mismatch occurs between the current and expected cookie signatures, the system inadvertently exposes the correct cookie signature to the user. An attacker can leverage this information to impersonate legitimate users or perform unauthorized actions within the affected system. This vulnerability is particularly concerning because it can be exploited over the network without requiring any user interaction or elevated privileges.

Impact Assessment:

• Integrity Impact: High – The ability to manipulate or forge cookie signatures compromises the system’s integrity.
• Confidentiality Impact: None – This vulnerability does not directly impact the confidentiality of the data.
• Availability Impact: None – This vulnerability does not affect the availability of the system.
• Attack Vector: Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity: High – Exploiting this vulnerability requires a specific set of conditions to be met.
• Privileges Required: None – The attacker does not need any special privileges to exploit this vulnerability.
• User Interaction: None – Exploitation can occur without any interaction from the user.

Mitigation Strategies:

To safeguard systems against this vulnerability, it is crucial to update to the latest versions of Apache Hive and Apache Spark where the issue has been addressed. Here are the recommended steps:

Update Software:

• Upgrade Apache Hive to version 4.0.0 or later.
• Upgrade Apache Spark to versions 3.0.0, 3.3.4, 3.4.2, or 3.5.0 and beyond.

Security Best Practices:

• Implement robust access controls to limit unauthorized access.
• Regularly review and monitor security logs for any unusual activity.
• Use network firewalls and intrusion detection/prevention systems to guard against potential attacks.

Cookie Management:

• Ensure that cookie signing mechanisms are properly configured.
• Conduct regular security audits to detect and remediate any potential vulnerabilities.

By adhering to these mitigation strategies, organizations can significantly reduce the risk posed by CVE-2024-23945 and maintain the security and integrity of their systems.