CVE-2025-62728
📋 TL;DR
This SQL injection vulnerability in Apache Hive Metastore Server allows authorized users to execute arbitrary SQL commands when calling Thrift APIs to delete column statistics. It affects Hive versions 4.1.0 through 4.2.0. The risk is limited since HMS is typically only accessible to trusted applications like Hiveserver2 in most deployments.
💻 Affected Systems
- Apache Hive Metastore Server
📦 What is this software?
Hive by Apache
⚠️ Risk & Real-World Impact
Worst Case
Authorized attackers could execute arbitrary SQL commands, potentially leading to data manipulation, data exfiltration, or denial of service.
Likely Case
Limited impact since only trusted applications can access the vulnerable Thrift APIs in typical deployments, and many installations already have metastore.try.direct.sql set to false.
If Mitigated
No impact if metastore.try.direct.sql is set to false or if HMS Thrift APIs are not exposed to untrusted users.
🎯 Exploit Status
Exploitation requires authorized access to HMS Thrift APIs and knowledge of SQL injection techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.0
Vendor Advisory: https://lists.apache.org/thread/yj65dd8dmzgy8p3nv8zy33v8knzg9o7g
Restart Required: Yes
Instructions:
1. Download Apache Hive 4.2.0 or later. 2. Stop Hive Metastore Server. 3. Replace existing installation with patched version. 4. Restart Hive Metastore Server.
🔧 Temporary Workarounds
Disable direct SQL execution
allSet metastore.try.direct.sql property to false to prevent reaching vulnerable code path
Set metastore.try.direct.sql=false in hive-site.xml or equivalent configuration
🧯 If You Can't Patch
- Restrict access to HMS Thrift APIs to only trusted applications
- Implement network segmentation to isolate HMS from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check Hive version and verify if metastore.try.direct.sql is set to trueCheck Version:
hive --versionVerify Fix Applied:
Verify Hive version is 4.2.0 or later, or confirm metastore.try.direct.sql is set to false📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in HMS logs
- Multiple delete column statistics requests from single source
- SQL syntax errors in Thrift API logs
Network Indicators:
- Unusual traffic patterns to HMS Thrift API endpoints
- SQL injection patterns in API requests
SIEM Query:
source="hive-metastore.log" AND ("delete column statistics" OR "CWE-89" OR "SQL injection")