[HIVE-22073] SQL Injection in TxnHandler#enqueueLockWithRetry

• Type: Bug
• Status: Open
• Priority: Critical
• Resolution: Unresolved
• Affects Version/s: 3.1.1
• Assignee: Unassigned
• Reporter: Piotr Findeisen
• Created: 01/Aug/19 20:49
• Updated: 15/Jun/22 07:40

Description

The org.apache.hadoop.hive.metastore.txn.TxnHandler#enqueueLockWithRetry method gets called for Thrift lock API call with input passed from the user.

Within that method there is SQL injection possible:

https://github.com/apache/hive/blob/774a8ef7a6e92c8a43cad2fa66bd944e666f75f0/standalone-metastore/src/main/java/org/apache/hadoop/hive/metastore/txn/TxnHandler.java#L1987-L1991

for example, when partition name contains an apostrophe.

 

Impact:

• vulnerability: privilege escalation possible
• availability: user cannot query ACID table where string/varchar partition key contains an apostrophe

 

 

 

Issue Links

• relates to: HIVE-20607 TxnHandler should use PreparedStatement to execute direct SQL queries.