CVE-2021-33036: Apache Hadoop Privilege Escalation Flaw

CVE-2021-33036 Overview

CVE-2021-33036 is a privilege escalation vulnerability affecting Apache Hadoop that allows a user who can escalate to the yarn user to potentially execute arbitrary commands as root. This vulnerability stems from path traversal weaknesses (CWE-22, CWE-24) in the YARN (Yet Another Resource Negotiator) component, which is responsible for cluster resource management and job scheduling in Hadoop deployments.

The vulnerability affects multiple major Hadoop version branches, making it a significant concern for organizations running big data infrastructure. Successful exploitation could lead to complete system compromise, allowing attackers to gain full administrative control over Hadoop cluster nodes.

Critical Impact

Attackers who can escalate to the yarn user may execute arbitrary commands with root privileges, potentially compromising entire Hadoop cluster infrastructure.

Affected Products

• Apache Hadoop versions 2.2.0 to 2.10.1
• Apache Hadoop versions 3.0.0-alpha1 to 3.1.4
• Apache Hadoop versions 3.2.0 to 3.2.2
• Apache Hadoop versions 3.3.0 to 3.3.1

Discovery Timeline

• June 15, 2022 - CVE-2021-33036 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-33036

Vulnerability Analysis

This privilege escalation vulnerability exists in Apache Hadoop's YARN component and is classified under CWE-22 (Path Traversal) and CWE-24 (Path Traversal: '../filedir'). The vulnerability allows an attacker who has already gained access as the yarn user to leverage improper path handling to escalate their privileges to root.

The attack requires low privileges and no user interaction, making it relatively straightforward for an attacker who has established initial access to the system. Once exploited, the attacker gains complete control over the affected node, with the ability to execute arbitrary commands with root privileges.

Root Cause

The root cause of CVE-2021-33036 lies in insufficient validation of file paths within the YARN component. The vulnerability allows path traversal sequences (such as ../) to escape intended directory boundaries. This improper neutralization of special elements used in path names enables attackers to access or manipulate files outside the intended directory structure, ultimately leading to privilege escalation.

The YARN service processes certain file operations with elevated privileges, and the path traversal weakness allows an attacker controlling the yarn user to inject malicious path components that result in operations being performed with root privileges.

Attack Vector

The attack vector is network-based, requiring the attacker to first authenticate as a low-privileged user capable of escalating to the yarn user. The attack flow typically involves:

1. Initial access to the Hadoop cluster with minimal privileges
2. Escalation to the yarn user account through legitimate means or other vulnerabilities
3. Exploitation of the path traversal vulnerability to inject malicious path sequences
4. Execution of arbitrary commands with root-level privileges

The path traversal vulnerability is exploited by crafting requests that contain directory traversal sequences, allowing the attacker to escape the intended directory boundaries and access sensitive system resources or execute privileged operations.

Detection Methods for CVE-2021-33036

Indicators of Compromise

• Unusual process execution originating from the yarn user with root privileges
• Log entries showing path traversal patterns (e.g., ../ sequences) in YARN-related operations
• Unexpected file access or modifications in system directories by YARN processes
• Authentication or authorization anomalies involving the yarn service account

Detection Strategies

• Monitor YARN service logs for suspicious path patterns containing directory traversal sequences
• Implement file integrity monitoring on critical system directories to detect unauthorized modifications
• Configure security information and event management (SIEM) rules to alert on privilege escalation patterns from the yarn user
• Deploy endpoint detection solutions capable of identifying anomalous process hierarchies and privilege changes

Monitoring Recommendations

• Enable verbose logging for YARN ResourceManager and NodeManager components
• Monitor process trees for unexpected parent-child relationships involving yarn processes and root-privileged operations
• Implement network segmentation to limit lateral movement within Hadoop clusters
• Review authentication logs for anomalous yarn user activity patterns

How to Mitigate CVE-2021-33036

Immediate Actions Required

• Identify all Apache Hadoop installations within the affected version ranges (2.2.0 to 2.10.1, 3.0.0-alpha1 to 3.1.4, 3.2.0 to 3.2.2, 3.3.0 to 3.3.1)
• Prioritize patching based on exposure level and criticality of Hadoop cluster data
• Review access controls for the yarn user and restrict unnecessary privileges
• Audit recent yarn user activity for signs of compromise

Patch Information

Apache has released patched versions that address this vulnerability. Organizations should upgrade to the following versions or higher:

• Apache Hadoop 2.10.2 (for 2.x branch users)
• Apache Hadoop 3.2.3 (for 3.2.x branch users)
• Apache Hadoop 3.3.2 (for 3.3.x branch users)

For detailed patch information, refer to the Apache Mailing List Thread and the NetApp Security Advisory.

Workarounds

• Implement strict access controls to limit who can escalate to the yarn user
• Apply network segmentation to isolate Hadoop cluster nodes from sensitive systems
• Monitor and restrict the yarn user's ability to execute system commands
• Consider implementing additional container isolation for YARN workloads where possible