CVE-2018-1315: Arbitrary File Write in Apache Hive

The vulnerability stems from insufficient validation of the destination path when downloading files via FTP using HPL/SQL in Apache Hive. An attacker controlling a malicious FTP server could exploit this by providing a crafted file path that writes the downloaded file to a location outside the intended directory. This could lead to overwriting critical system files, injecting malicious code, or gaining unauthorized access to sensitive data. The impact is particularly severe as it allows for arbitrary file writes, potentially leading to complete system compromise. This is not a risk for users of the Hive CLI or HiveServer2 as HPL/SQL is invoked separately.

1. Published2018-11-21
2. Modified2023-11-08
3. EPSS updated2026-04-02

The primary mitigation is to upgrade Apache Hive to version 2.3.3 or later, which includes the necessary fix. If upgrading is not immediately feasible, consider implementing strict destination path verification within your HPL/SQL scripts to ensure files are only written to authorized locations. Additionally, restrict access to the HPL/SQL command-line script and carefully audit FTP server configurations. Consider using a Web Application Firewall (WAF) to filter potentially malicious FTP requests. After upgrading, confirm the fix by attempting a 'COPY FROM FTP' operation with a known malicious FTP server and verifying that the file is not written to an unexpected location.