CVE-2024-23454: Apache Hadoop Information Disclosure Flaw

CVE-2024-23454 Overview

CVE-2024-23454 is an insecure permissions vulnerability in Apache Hadoop's RunJar.run() function that fails to set proper permissions for temporary directories by default. On Unix-like systems, the system temporary directory is shared between all local users. When sensitive data is written to files in this directory without explicitly setting correct POSIX permissions, all other local users on the system may be able to view the content, leading to potential information disclosure.

Critical Impact

Local users on shared systems running Apache Hadoop could access sensitive data written to temporary directories by other users, potentially exposing credentials, configuration data, or application-specific sensitive information.

Affected Products

• Apache Hadoop (all affected versions)

Discovery Timeline

• 2024-09-25 - CVE-2024-23454 published to NVD
• 2025-11-13 - Last updated in NVD database

Technical Details for CVE-2024-23454

Vulnerability Analysis

This vulnerability stems from CWE-378 (Creation of Temporary File With Insecure Permissions). The RunJar.run() method in Apache Hadoop creates temporary files without explicitly setting restrictive POSIX permissions. In multi-user Unix-like environments, the system's temporary directory (typically /tmp) is world-readable by default. When Hadoop writes files to this location, any local user can potentially read the contents of these temporary files if they contain sensitive information such as configuration data, intermediate processing results, or cached credentials.

The attack requires local access to the affected system, making it most relevant in shared computing environments, multi-tenant clusters, or development systems with multiple user accounts.

Root Cause

The root cause is the failure to explicitly set secure file permissions when creating temporary files in the RunJar.run() method. By default, files created in the system temporary directory inherit permissive umask settings, allowing read access to all local users. The code does not call appropriate system APIs to restrict file permissions to owner-only access (e.g., mode 0600 or 0700).

Attack Vector

The vulnerability requires local access to exploit. An attacker with a valid user account on the same system can:

1. Monitor the system temporary directory for files created by Hadoop processes
2. Read the contents of temporary files created by RunJar.run() before they are cleaned up
3. Extract any sensitive data present in these files, such as configuration parameters, intermediate data, or credentials

The attack does not require any user interaction and can be performed with standard user privileges. No authentication bypass is needed since the attacker already has legitimate local access.

Detection Methods for CVE-2024-23454

Indicators of Compromise

• Unusual read access patterns to Hadoop temporary files in /tmp or the configured temporary directory
• Unauthorized users accessing files created by Hadoop service accounts
• File access audit logs showing cross-user temporary file reads
• Processes monitoring or repeatedly accessing the system temporary directory

Detection Strategies

• Enable file system auditing on the temporary directory to track read operations
• Monitor for users other than the Hadoop service account accessing Hadoop-related temporary files
• Implement process monitoring to detect scripts or tools scanning the /tmp directory
• Review system logs for anomalous file access patterns involving Hadoop processes

Monitoring Recommendations

• Configure auditd rules to track access to Hadoop temporary files
• Implement SentinelOne's file integrity monitoring to detect unauthorized access
• Set up alerts for any non-Hadoop users reading files in Hadoop's temporary directory
• Periodically review file permissions in the system temporary directory

How to Mitigate CVE-2024-23454

Immediate Actions Required

• Review all Apache Hadoop installations for exposure to this vulnerability
• Restrict local user access on systems running Apache Hadoop where possible
• Configure a dedicated temporary directory with restrictive permissions for Hadoop processes
• Apply the vendor patch as soon as it becomes available for your Hadoop version

Patch Information

Apache has addressed this issue and tracks it under HADOOP-19031. Users should consult the Apache Mailing List Thread for the latest patch information and upgrade guidance. NetApp customers should also review the NetApp Security Advisory NTAP-20241101-0002 for product-specific guidance.

Workarounds

• Configure Hadoop to use a dedicated temporary directory with restricted permissions (mode 0700)
• Set a restrictive umask (e.g., 0077) for Hadoop processes before execution
• Limit local user accounts on systems running Apache Hadoop to only necessary personnel
• Use operating system-level access controls to restrict temporary directory visibility

# Configuration example - Set restrictive umask for Hadoop processes
# Add to hadoop-env.sh or execution scripts
umask 0077

# Create a dedicated temporary directory with restricted permissions
mkdir -p /var/hadoop/tmp
chmod 700 /var/hadoop/tmp
chown hadoop:hadoop /var/hadoop/tmp

# Configure Hadoop to use the dedicated temporary directory
# Set in core-site.xml or via environment variable
export HADOOP_TMP_DIR=/var/hadoop/tmp