=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN385
_____________________________________________________________________

DATE                : 23/07/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Impala versions prior to
                                        4.0.

=====================================================================
http://mail-archives.apache.org/mod_mbox/www-announce/202107.mbox/%3ce7cdb39c-f4f4-a68f-20d9-6303a31073d5@apache.org%3e
_____________________________________________________________________

CVE-2021-28131: Apache Impala: Impala logs contain secrets

Severity: high

Description:

Impala sessions use a 16 byte secret to verify that the session is not
being hijacked by another user. However, these
secrets appear in the Impala logs, therefore Impala users with access to
the logs can use another authenticated user's
sessions with specially constructed requests. This means the attacker is
able to execute statements for which they don't have the necessary
privileges otherwise.

Impala deployments with Apache Sentry or Apache Ranger authorization
enabled may be vulnerable to privilege escalation if an authenticated
attacker is able to hijack a session or query from another authenticated
user with privileges not assigned to the attacker.

Impala deployments with audit logging enabled may be vulnerable to
incorrect audit logging as a user could undertake actions that were
logged under the name of a different authenticated user.

Constructing an attack requires a high degree of technical
sophistication and access to the Impala system as an authenticated user.

Mitigation: If an Impala deployment uses Apache Sentry, Apache Ranger or
audit logging, then users should upgrade to a version of Impala with the
fix for IMPALA-10600. The Impala 4.0 release includes this fix. This
hides session secrets from the logs to eliminate the risk of any attack
using this mechanism.

In lieu of an upgrade, restricting access to logs that expose secrets
will reduce the risk of an attack. Restricting access to the Impala
deployment to trusted users will also reduce the risk of an attack. Log
redaction techniques can
be used to redact secrets from the logs.



=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================