CVE-2018-1315

Vulnerability

In Apache Hive versions 2.1.0 to 2.3.2, the HPL/SQL extension's COPY FROM FTP statement does not validate the destination path of files downloaded from an FTP server. The FTP client code in HPL/SQL trusts the server-provided filename and writes it to the specified local directory without sanitization. This flaw is present only when HPL/SQL is invoked as a separate command-line script (hplsql); the standard Hive CLI and HiveServer2 are unaffected [1][2].

Exploitation

An attacker must operate a compromised or malicious FTP server that the HPL/SQL client connects to. When a user executes a COPY FROM FTP statement, the attacker-controlled FTP server can return a crafted filename containing path traversal characters (e.g., ../../) or an absolute path, causing the downloaded file to be written to an arbitrary location on the cluster filesystem. No additional authentication or user interaction beyond initiating the FTP transfer is required [1].

Impact

Successful exploitation allows an attacker to write arbitrary file content to any location writable by the HPL/SQL process on the cluster. This could lead to overwriting configuration files, planting cron jobs, or inserting malicious scripts, potentially resulting in privilege escalation or remote code execution on the Hive cluster [1][2].

Mitigation

Upgrade to Apache Hive 2.3.3 or later, which contains the fix that validates destination filenames during FTP transfers [2]. If upgrading is not immediately possible, avoid using the HPL/SQL extension with untrusted FTP servers. This issue is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of publication date.