Listen to this Post
How the mentioned CVE works:
The vulnerability exists within the `deletePartitionColumnStatistics` and `deleteTableColumnStatistics` methods of the Hive Metastore Server’s Thrift API interface. When a trusted client sends a request to delete column statistics, user-supplied inputs for database, table, and partition names are passed to underlying SQL generation logic without adequate sanitization. If the `metastore.try.direct.sql` configuration property is set to `true` (the default in affected versions), the metastore attempts to execute a direct SQL DELETE statement against its backing relational database (e.g., MySQL, PostgreSQL). The unsanitized inputs are concatenated directly into the SQL command string, allowing an authenticated attacker to inject arbitrary SQL commands. This can lead to data manipulation, corruption, or information disclosure within the metastore database, which controls the schema and metadata for large-scale data warehouses.
DailyCVE Form:
Platform: Apache Hive Metastore
Version: 4.1.0 to <4.2.0
Vulnerability: SQL Injection
Severity: High
Date: Dec 1, 2025
Prediction: Patch Released (Nov 26, 2025)
What Undercode Say:
Analytics:
Check Hive Metastore version hive --service metastore --version Find running HMS instances ps aux | grep hive.metastore.server.HiveMetaStore Check configuration for vulnerable setting grep -r "metastore.try.direct.sql" /etc/hive/ /usr/lib/hive/conf/
// Example vulnerable code path in org.apache.hadoop.hive.metastore.HiveMetaStore
// User input flows into DirectSQL.executeStatements()
public void deletePartitionColumnStatistics(... String dbName, String tableName, ...) throws MetaException {
// ...
if (useDirectSql) {
directSql.deletePartitionColumnStatistics(dbName, tableName, partName, colName);
}
}
How Exploit:
1. Acquire trusted HMS Thrift API credentials.
2. Craft a malicious `deleteTableColumnStatistics` Thrift call.
- Inject SQL payload into the `tableName` parameter (e.g.,
"test'; DROP TABLE TBLS; --"). - Send request to metastore server’s Thrift port (typically 9083).
- Injected SQL executes on backend RDBMS with metastore permissions.
Protection from this CVE:
Upgrade to Hive 4.2.0.
Set `metastore.try.direct.sql=false`.
Network isolate HMS Thrift API.
Apply principle of least privilege.
Impact:
Authenticated SQLi.
Metastore database compromise.
Data warehouse metadata manipulation.
Limited by trusted user requirement.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
