CVE-2018-1296

Vulnerability

In Apache Hadoop 3.0.0-alpha1 to 3.0.0, 2.9.0, 2.8.0 to 2.8.3, and 2.5.0 to 2.7.5, the HDFS listXAttrs operation only verifies path-level search access to the directory, instead of path-level read permission on the referent file or directory [1][2]. This allows unauthorized retrieval of extended attribute key/value pairs for any entity in the filesystem.

Exploitation

An authenticated attacker who has search (execute) permission on a parent directory, but lacks read permission on a specific file or directory within it, can still call listXAttrs on that referent to enumerate its extended attribute names and values [2]. No additional privileges or race conditions are required; the attacker only needs network access to an HDFS NameNode or gateway that exposes the listXAttrs RPC.

Impact

Successful exploitation results in unauthorized disclosure of sensitive data stored in HDFS extended attributes, leading to a breach of confidentiality [1][2]. The attacker does not gain write access or code execution; the impact is limited to information exposure.

Mitigation

The vulnerability is fixed in Hadoop 2.7.6, 2.8.4, and 2.9.1 [2]. Users should upgrade to one of these patched versions. There is no workaround available for unpatched releases, and affected versions remain at risk until updated.