Apache Ranger: code execution vulnerability in policy expressions

Vulnerability

Overview

CVE-2022-45048 is a code execution vulnerability in Apache Ranger version 2.3.0. The root cause lies in the policy creation mechanism: authenticated users who have sufficient privileges can craft policies containing specially crafted expressions. These expressions, when evaluated, can lead to arbitrary code execution on the server [1][2].

Attack

Vector and Prerequisites

An attacker must first obtain valid credentials for an Apache Ranger instance and possess the necessary privileges to create or modify security policies. No other special network access is required beyond being able to reach the Ranger admin console or API. The vulnerability is triggered when the malicious policy expression is processed by the Ranger backend [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Ranger server. This could lead to full compromise of the Ranger instance, including access to sensitive data that Ranger manages (e.g., Hadoop cluster security metadata). The impact is high because Ranger often holds credentials and policies for multiple data services [2].

Mitigation

The Apache Software Foundation released Apache Ranger version 2.4.0, which addresses this vulnerability. Users running 2.3.0 are strongly advised to upgrade immediately. No workarounds have been publicly disclosed [2]. The issue was reported via the Apache security mailing list.