Arbitrary file write in FileUtil#unpackEntries on Windows

Vulnerability

The unTar function in Apache Hadoop uses unTarUsingJava on Windows and the built-in tar utility on Unix. A TAR entry can create a symbolic link within the extraction directory pointing to an external directory; a subsequent entry can extract an arbitrary file into that external directory via the symlink. This affects all versions prior to Apache Hadoop 3.2.3 [1][2].

Exploitation

An attacker must have the ability to supply a crafted TAR archive to the extraction function (e.g., through a Hadoop service that processes user-uploaded TAR files). On Windows, getCanonicalPath does not resolve symbolic links, so the targetDirPath check is bypassed. The exploitation sequence involves a TAR entry that creates a symlink (e.g., pointing to C:\Windows), followed by an entry that writes a malicious file using that symlink path [1].

Impact

Successful exploitation allows an attacker to write arbitrary files to any location on the Windows filesystem that the Hadoop process can access. This could result in remote code execution, privilege escalation, or data compromise [1].

Mitigation

The vulnerability is fixed in Apache Hadoop 3.2.3 [1][2]. Users should upgrade to this version or later. No workarounds are documented; running Hadoop on Windows with untrusted TAR extraction is not recommended without the fix.