[HADOOP-19325] hadoop-rumen is vulnerable to Sonatype CWE611

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 3.4.0, 3.3.6, 3.4.1
• Component/s: security, tools
• Assignee: Unassigned
• Reporter: Palakur Eshwitha Sai
• Created: 05/Nov/24 10:23
• Updated: 06/Nov/24 05:40
• Resolved: 05/Nov/24 19:20

Description

hadoop-rumen is vulnerable to CWE-611: Improper Restriction of XML External Entity Reference.

sonatype-2022-5820

Explanation: The Apache hadoop-common and hadoop-rumen packages are vulnerable to XML External Entity (XXE) attacks. The readXmlFileToMapWithFileInputStream() method in the HostsFileReader class, the parse() method in the JobConfigurationParser class, and the constructor in the ParsedConfigFile class process malicious external entities by default due to an unsafe XML parser configuration. A remote attacker who can supply or modify the contents of hosts or configuration XML files parsed by these packages can exploit this vulnerability to exfiltrate information, cause a Denial of Service (DoS) condition, or perform other XXE-related attacks.

Root Cause: org/apache/hadoop/tools/rumen/JobConfigurationParser.class, org/apache/hadoop/tools/rumen/ParsedConfigFile.class

Issue Links

• is fixed by: HADOOP-18469 Add XMLUtils methods to centralise code that creates secure XML parsers