CVE-2018-11765

Vulnerability

Description

When Kerberos authentication is enabled in Apache Hadoop, the SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism) through HTTP is expected to protect access to servlets. However, in affected versions — including all releases from 3.0.0-alpha2 to 3.0.0, 2.9.0 to 2.9.2, and 2.8.0 to 2.8.5 — an attacker can bypass this protection. The root cause lies in the failure to enforce authentication on some servlets when SPNEGO is not active over HTTP, leaving a gap in the access control logic.

Attack

Surface and Exploitation

An attacker does not need any prior authentication or special privileges. By simply sending HTTP requests to the vulnerable servlets, they can interact with Apache Hadoop services. This is exploitable over the network without any credentials, requiring only that Kerberos be enabled and SPNEGO disabled or misconfigured.

Impact

Unauthenticated access to these servlets may allow an attacker to read sensitive data, trigger actions, or perform operations that should require authentication. The severity is rated as critical, as it undermines the intended security posture of the Hadoop deployment.

Mitigation

Apache Software Foundation has released patches in newer versions. Users should upgrade to Hadoop 3.0.1, 2.9.3, 2.8.6, or later. If upgrading is not immediately possible, administrators can consider enabling SPNEGO over HTTP or implementing additional network-level access controls to protect these endpoints [1].