[
https://issues.apache.org/jira/browse/HIVE-29653?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sai Hemanth Gantasala updated HIVE-29653:
-----------------------------------------
Security: (was: Non-Public)
> Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token
> validation allows impersonation of any Hive user.
> -----------------------------------------------------------------------------------------------------------------------------
>
> Key: HIVE-29653
> URL: https://issues.apache.org/jira/browse/HIVE-29653
> Project: Hive
> Issue Type: Bug
> Components: HiveServer2
> Affects Versions: 4.2.0
> Reporter: Sai Hemanth Gantasala
> Assignee: Sai Hemanth Gantasala
> Priority: Critical
> Fix For: 4.2.1
>
>
> HiveServer2 supports SAML 2.0 authentication in HTTP transport mode
> ({{{}hive.server2.authentication=SAML{}}}, JDBC {{{}auth=browser{}}}). After
> a successful IdP login, HS2 issues an internal bearer token that JDBC clients
> present on subsequent {{POST /cliservice}} requests.
> A logic error in {{HiveSamlAuthTokenGenerator.signatureMatches()}} inverts
> the result of {{{}MessageDigest.isEqual(){}}}, causing mismatched signatures
> to be treated as valid and matching signatures to be rejected. An
> unauthenticated attacker who can reach the HS2 HTTP {{/cliservice}} endpoint
> can forge a bearer token with an arbitrary username and obtain an
> authenticated HS2 session without knowing the server signing secret or
> completing the SAML IdP flow.
> This was confirmed on the official Apache Hive 4.2.0 container image and is
> present in upstream code since SAML support was introduced (HIVE-24543).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
