Arbitrary File Write Vulnerability in Apache Hive by Apache

CVE-2018-1315

Summary

The Apache Hive vulnerability allows an attacker to exploit the 'COPY FROM FTP' statement executed through the HPL/SQL extension. If a compromised FTP server is accessed, files can be written to any location on the cluster where the command is executed. This occurs due to the lack of verification in the destination path for downloaded files by the FTP client in HPL/SQL. Notably, this issue does not affect users operating through hive cli or hiveserver2, given the distinct invocation process of the HPL/SQL command line script.

References