Listen to this Post
How the CVE Works:
This SQL injection vulnerability exists within the `deleteTableColumnStatistics` method of the Hive Metastore Server’s Thrift API handler. When a trusted/authorized client sends a request to delete column statistics, user-controlled input from the Thrift call parameters (like database name, table name, column name) is improperly concatenated into a SQL string without adequate sanitization. This string is executed directly against the metastore’s backend SQL database (e.g., MySQL, PostgreSQL) if the `metastore.try.direct.sql` property is true. An attacker with valid Thrift API access can craft malicious input to alter the intended SQL command, potentially allowing data manipulation or exfiltration from the metastore database.
Platform: Apache Hive Metastore
Version: 4.1.0 to 4.1.x
Vulnerability: SQL Injection
Severity: Medium
date: 2025-11-26
Prediction: Patch available: 2025-11-26
What Undercode Say:
curl -X POST http://metastore-host:9083/ --data-binary @malicious_thrift_payload.bin sqlmap -u 'http://metastore-host:9083/' --data='thrift_payload' --risk=3 grep -r "deleteTableColumnStatistics" hive-metastore-source-code/ cat >> /etc/hive/conf/hive-site.xml << EOL <property> <name>metastore.try.direct.sql</name> <value>false</value> </property> EOL
How Exploit:
Authenticated attacker sends crafted Thrift RPC call to the vulnerable `deleteTableColumnStatistics` endpoint, injecting SQL payloads within standard parameters like column name (e.g., column'; DROP TABLE test;--). The payload executes directly on the underlying RDBMS when direct SQL is enabled.
Protection from this CVE:
Upgrade to Hive 4.2.0. Set configuration property metastore.try.direct.sql=false. Restrict network access to Metastore Thrift API ports (default 9083). Apply principle of least privilege to metastore database accounts.
Impact:
Authenticated SQL injection. Potential for unauthorized data access, modification, or denial of service within the Hive metastore database. Requires trusted client access.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
