CVE-2024-23945
📋 TL;DR
Apache Hive and Spark expose correct cookie signatures during signature mismatch errors, potentially allowing attackers to forge valid signed cookies. This affects systems using Hive service or Spark Hive ThriftServer components. The vulnerability could lead to authentication bypass or session hijacking.
💻 Affected Systems
- Apache Hive
- Apache Spark
📦 What is this software?
Hive by Apache
Spark by Apache
Spark by Apache
Spark by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain valid cookie signatures and forge authenticated sessions, leading to unauthorized access, data manipulation, or privilege escalation.
Likely Case
Information disclosure of cookie signatures that could be used in combination with other vulnerabilities for session hijacking or authentication bypass.
If Mitigated
Limited impact with proper network segmentation, monitoring, and defense-in-depth controls that detect abnormal cookie activity.
🎯 Exploit Status
Exploitation requires triggering signature mismatch errors and then using disclosed signatures to forge cookies. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check specific commits: Hive commit 7638cb1a3b07713cc490aa2909a37037f89e08b4, Spark commit cf59b1f51c16301f689b4e0f17ba4dbd140e1b19
Vendor Advisory: https://issues.apache.org/jira/browse/HIVE-9710
Restart Required: Yes
Instructions:
1. Update Apache Hive to version with fix commit 7638cb1a3b. 2. Update Apache Spark to version with fix commit cf59b1f51c. 3. Restart affected Hive service or Spark ThriftServer components.
🔧 Temporary Workarounds
Disable cookie signing
allTemporarily disable cookie signing feature to prevent signature exposure
Configure hive.server2.use.SSL=false and adjust authentication settings
Network isolation
allRestrict access to Hive/Spark services to trusted networks only
Use firewall rules to limit access to specific IP ranges
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to Hive/Spark services
- Enable detailed logging and monitoring for cookie signature mismatch errors
🔍 How to Verify
Check if Vulnerable:
Check if running Hive 1.2.0+ or Spark 2.0.0+ with Hive ThriftServer, and verify if cookie signing is enabled in configuration.Check Version:
For Hive: hive --version, For Spark: spark-submit --versionVerify Fix Applied:
Verify that the fix commits are present in your Hive/Spark installation and test that cookie signature mismatches no longer expose correct signatures.📡 Detection & Monitoring
Log Indicators:
- Cookie signature mismatch errors in Hive/Spark logs
- Multiple failed authentication attempts with cookie errors
Network Indicators:
- Unusual patterns of requests triggering authentication errors
- Requests attempting to manipulate cookie signatures
SIEM Query:
source="hive.log" OR source="spark.log" AND ("signature mismatch" OR "cookie error" OR "authentication failure")🔗 References
- https://github.com/apache/hive
- https://github.com/apache/hive/commit/7638cb1a3b07713cc490aa2909a37037f89e08b4
- https://github.com/apache/spark
- https://github.com/apache/spark/commit/cf59b1f51c16301f689b4e0f17ba4dbd140e1b19
- https://issues.apache.org/jira/browse/HIVE-9710
- https://issues.apache.org/jira/browse/SPARK-14987
- https://lists.apache.org/thread/59r4mv7glrxpwkkdjvjbdljfpx3f5zzc
- https://lists.apache.org/thread/5o2ljnzrv8zvhjw9vy7b4rwjpc32hgfc
- http://www.openwall.com/lists/oss-security/2024/12/23/2
