CVE-2022-26612 : Vulnerability Insights and Analysis

Apache Hadoop, specifically versions prior to 3.2.3, 3.3.1, and 3.3.2 on Windows, is affected by a vulnerability that allows an arbitrary file write. This issue was reported by a member of GitHub Security Lab, Jaroslav Lobačevski.

Understanding CVE-2022-26612

This CVE involves the Apache Hadoop software on Windows, where a TAR entry may create a symlink that points to an external directory, enabling the extraction of arbitrary files outside the expected base directory.

What is CVE-2022-26612?

In Apache Hadoop, the TAR extraction function allows symbolic links to be followed on Windows, leading to files being written outside the intended directory, posing a security risk.

The Impact of CVE-2022-26612

The vulnerability could potentially allow an attacker to write files to unintended locations on Windows machines, compromising the integrity and security of the system.

Technical Details of CVE-2022-26612

Vulnerability Description

The vulnerability in Apache Hadoop's unpackEntries function enables the writing of files to locations beyond the expected base directory due to the way symbolic links are handled on Windows.

Affected Systems and Versions

Platforms: Windows
Affected Versions: Apache Hadoop versions less than 3.2.3, 3.3.1, 3.3.2

Exploitation Mechanism

By creating a TAR entry that creates a symbolic link to an external directory and subsequently extracting arbitrary files using the symlink name, attackers can bypass directory checks on Windows.

Mitigation and Prevention

Immediate Steps to Take

Users are advised to update their Apache Hadoop installations to version 3.2.3 or later to mitigate the vulnerability. It is crucial to apply security patches promptly to protect systems.

Long-Term Security Practices

Implement regular security audits and reviews to identify and address potential vulnerabilities in software. Follow security best practices to secure file extraction and handle symbolic links securely.

Patching and Updates

Stay informed about security updates and patches released by Apache Hadoop. Regularly update the software to the latest versions to ensure that known vulnerabilities are mitigated.