CVE-2022-25168
published 2022-08-04CVE-2022-25168: Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands…
PriorityP260critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
3.39%
87.5th percentile
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop libraries are in use. Users should upgrade to Apache Hadoop 2.10.2, 3.2.4, 3.3.3 or upper (including HADOOP-18136).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | hadoop | — | — |
| apache | hadoop | 2.0.0 – 2.10.1 | — |
| apache | hadoop | 3.0.0 – 3.2.3 | — |
| apache | hadoop | 3.3.0 – 3.3.2 | — |
| apache_software_foundation | apache_hadoop | — | — |
| apache_software_foundation | apache_hadoop | — | — |
| apache_software_foundation | apache_hadoop | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The vulnerable code path is in `org.apache.hadoop.fs.FileUtil.unTarUsingTar` — monitor for shell process spawning from this Java method, particularly in Hadoop 2.x yarn localization contexts where remote code execution is possible. ↗
- →In Apache Spark environments, monitor for use of the SQL command `ADD ARCHIVE` with crafted archive filenames containing shell metacharacters (e.g., `;`, `|`, `$()`, backticks) that could inject commands when passed to `FileUtil.unTar`. ↗
- →In Hadoop 2.x, the vulnerable code is exercised during YARN localization — monitor for unexpected shell command execution spawned from YARN NodeManager processes, which could indicate remote exploitation. ↗
- →In Hadoop 3.3, the vulnerable path is `InMemoryAliasMap.completeBootstrapTransfer` — exploitation is limited to local users, so monitor for unexpected local process execution from this code path. ↗
- →Red Hat OpenShift Container Platform 4 package `openshift4/ose-metering-hadoop` is confirmed affected — prioritize detection and patching in OCP4 metering deployments. ↗
- ·The Spark-side fix (SPARK-38305) prevents shell command injection regardless of the underlying Hadoop library version — environments running Spark 3.3.0, 3.1.4, or 3.2.2+ are protected on the Spark side even if Hadoop is unpatched. ↗
- ·The `ADD ARCHIVE` exploitation vector in Spark does not grant the attacker new permissions beyond what the SQL caller already has, limiting the practical impact in Spark-only deployments. ↗
- ·The fix is tracked as HADOOP-18136; patched versions are Apache Hadoop 2.10.2, 3.2.4, and 3.3.3 or later. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_apache9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Apache Hadoop argument injection vulnerability
osv·2022-08-05
CVE-2022-25168 [CRITICAL] Apache Hadoop argument injection vulnerability
Apache Hadoop argument injection vulnerability
Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which vers
GHSA
Apache Hadoop argument injection vulnerability
ghsa·2022-08-05
CVE-2022-25168 [CRITICAL] CWE-78 Apache Hadoop argument injection vulnerability
Apache Hadoop argument injection vulnerability
Apache Hadoop's `FileUtil.unTar(File, File)` API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which vers
Red Hat
hadoop: Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
vendor_redhat·2022-08-08·CVSS 9.8
CVE-2022-25168 [CRITICAL] CWE-88 hadoop: Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
hadoop: Command injection in org.apache.hadoop.fs.FileUtil.unTarUsingTar
Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. "Check existence of file before untarring/zipping", which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed,
Apache
Apache hadoop: CVE-2022-25168
vendor_apache·CVSS 9.8
CVE-2022-25168 [CRITICAL] Apache hadoop: CVE-2022-25168
Apache hadoop: CVE-2022-25168
Apache Hadoop’s FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in Hadoop 2.x for yarn localization, which does enable remote code execution. It is used in Apache Spark, from the SQL command ADD ARCHIVE. As the ADD ARCHIVE command adds new binaries to the classpath, being able to execute shell scripts does not confer new permissions to the caller. SPARK-38305. “Check existence of file before untarring/zipping”, which is included in 3.3.0, 3.1.4, 3.2.2, prevents shell commands being executed, regardless of which version of the hadoop li
No detection rules found.
No public exploits indexed.
2022-08-04
Published