CVE-2024-54660

A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This could lead to remote code execution. JNDI injection is possible via the JDBC connection property krbJAASFile for the Java Authentication and Authorization Service (JAAS). Using untrusted parameters in the krbJAASFile and/or remote host can trigger JNDI injection in the JDBC URL through the krbJAASFile.

CVSS v3 8.7 HIGH

8.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179

Configurations

No configuration.

History

No history.

Information

Published : 2025-01-16 22:15

Updated : 2025-02-03 21:15

NVD link : CVE-2024-54660

Mitre link : CVE-2024-54660

CVE.ORG link : CVE-2024-54660

JSON object : View

Products Affected

No product.

CWE

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

{"id": "CVE-2024-54660", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}]}, "published": "2025-01-16T22:15:40.200", "references": [{"url": "https://www.blackhat.com/eu-24/briefings/schedule/index.html#a-novel-attack-surface-java-authentication-and-authorization-service-jaas-42179", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-77"}]}], "descriptions": [{"lang": "en", "value": "A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI injection during the process when the JDBC Driver uses this URL to connect to the database. This could lead to remote code execution. JNDI injection is possible via the JDBC connection property krbJAASFile for the Java Authentication and Authorization Service (JAAS). Using untrusted parameters in the krbJAASFile and/or remote host can trigger JNDI injection in the JDBC URL through the krbJAASFile."}, {"lang": "es", "value": " Se descubri\u00f3 un problema de inyecci\u00f3n JNDI en Cloudera JDBC Connector para Hive antes de la versi\u00f3n 2.6.26 y JDBC Connector para Impala antes de la versi\u00f3n 2.6.35. Los atacantes pueden inyectar par\u00e1metros maliciosos en la URL de JDBC, lo que activa la inyecci\u00f3n JNDI durante el proceso cuando el controlador JDBC usa esta URL para conectarse a la base de datos. Esto podr\u00eda provocar la ejecuci\u00f3n remota de c\u00f3digo. La inyecci\u00f3n JNDI es posible a trav\u00e9s de la propiedad de conexi\u00f3n JDBC krbJAASFile para el Servicio de autenticaci\u00f3n y autorizaci\u00f3n de Java (JAAS). El uso de par\u00e1metros no confiables en krbJAASFile o en el host remoto puede activar la inyecci\u00f3n JNDI en la URL de JDBC a trav\u00e9s de krbJAASFile."}], "lastModified": "2025-02-03T21:15:13.873", "sourceIdentifier": "cve@mitre.org"}