[HDFS-16766] hdfs ec command loads (administrator provided) erasure code policy files without disabling xml entity expansion

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.3.4
• Fix Version/s: 3.4.0, 3.3.5, 3.2.5
• Component/s: erasure-coding, security
• Labels: pull-request-available
• Target Version/s: 3.4.0, 3.3.5
• Hadoop Flags: Reviewed
• Assignee: Ashutosh Gupta
• Reporter: Jing
• Created: 09/Sep/22 21:32
• Updated: 28/Jan/24 08:08
• Resolved: 27/Sep/22 06:51

Description

XML External Entity (XXE) attacks can occur when an XML parser supports XML entities while processing XML received from an untrusted source. The attack resides in XML input containing references to an external entity an is parsed by the weakly configured javax.xml.parsers.DocumentBuilder XML parser.

 

https://github.com/apache/hadoop/blob/trunk/hadoop-hdfs-project/hadoop-hdfs-client/src/main/java/org/apache/hadoop/hdfs/util/ECPolicyLoader.java#L93

sonatype-2022-5732

If anyone is landing on this page following the sonatype-2022-5732 alert

1. the xml expansion only happens on the command line of the hdfs ec command https://hadoop.apache.org/docs/stable/hadoop-project-dist/hadoop-hdfs/HDFSErasureCoding.html#Administrative_commands
2. the outcome of entity expansion will be the command failing/running out of memory
3. if a cluster admin is loading erasure policies from untrusted sources, there are fundamental process issues to worry about beyond xml references

hdfs cluster administrators who receive XML erasure coding policies from untrusted sources (email etc) must sanitize the file by removing all &entity; references before using the "hdfs ec" command. otherwise the tool will fail before it has a chance to apply whatever the malicious EC policy was. Alternatively: do not configure your hadoop cluster from XML files you haven't written yourself.

Issue Links

• is related to: HDFS-16410 Insecure Xml parsing in OfflineEditsXmlLoader
• is related to: HADOOP-18469 Add XMLUtils methods to centralise code that creates secure XML parsers
• links to: GitHub Pull Request #4886