CVE-2024-54660: Cloudera JDBC Connector RCE Vulnerability

CVE-2024-54660 Overview

CVE-2024-54660 is a Java Naming and Directory Interface (JNDI) injection vulnerability in the Cloudera JDBC Connector for Hive before version 2.6.26 and the Cloudera JDBC Connector for Impala before version 2.6.35. Attackers can inject malicious parameters into the JDBC URL, triggering JNDI resolution when the driver connects to the database. The injection occurs through the krbJAASFile connection property used by the Java Authentication and Authorization Service (JAAS). Successful exploitation can result in remote code execution on systems using the vulnerable connector. The vulnerability is classified under [CWE-77] as a command injection weakness.

Critical Impact
Remote code execution through JNDI injection in the JDBC connection string, enabling attackers to load arbitrary Java classes from remote endpoints.

Affected Products

Cloudera JDBC Connector for Hive versions prior to 2.6.26
Cloudera JDBC Connector for Impala versions prior to 2.6.35
Applications embedding these connectors that accept untrusted JDBC URL parameters

Discovery Timeline

2025-01-16 - CVE-2024-54660 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-54660

Vulnerability Analysis

The vulnerability arises from unsafe handling of the krbJAASFile connection parameter within the Cloudera JDBC drivers for Hive and Impala. The connection property is intended to reference a local JAAS configuration file used during Kerberos authentication. The drivers do not properly validate this parameter, allowing attackers to supply values that trigger JNDI lookups against attacker-controlled endpoints. Once the JDBC driver initiates authentication, the JAAS layer performs a lookup that can resolve to a remote Lightweight Directory Access Protocol (LDAP) or Remote Method Invocation (RMI) reference.

Root Cause

The root cause is missing input validation on JDBC URL properties consumed by the JAAS subsystem. When the krbJAASFile property or an associated remote host parameter contains an attacker-controlled JNDI URL, the driver passes it to InitialContext.lookup() without restricting supported schemes. Java's default JNDI behavior resolves such references and instantiates remote objects, matching the classic JNDI injection pattern first popularized by the Log4Shell class of vulnerabilities.

Attack Vector

Exploitation requires an attacker to influence the JDBC connection string used by a target application. This is commonly achievable in applications that build JDBC URLs from user-supplied hostnames, database names, or connection options. When the vulnerable driver connects to the database, the injected krbJAASFile parameter triggers a JNDI lookup to an attacker-controlled server. The server returns a malicious object reference, which the driver deserializes and executes in the context of the connecting process. Technical details of this attack class were presented at BlackHat Europe 2024: A Novel Attack Surface — JAAS.

No verified public proof-of-concept code is included in the CVE record. See the referenced BlackHat briefing for exploitation mechanics.

Detection Methods for CVE-2024-54660

Indicators of Compromise

Outbound LDAP, LDAPS, RMI, or DNS traffic originating from Java processes that host Cloudera Hive or Impala JDBC drivers
JDBC connection strings in application logs containing krbJAASFile= with values pointing to remote hosts or non-file URI schemes
Unexpected child processes spawned by Java Virtual Machine (JVM) instances running the affected drivers
Loading of remote Java classes into the JVM after a JDBC connection attempt

Detection Strategies

Inspect application and driver logs for JDBC URLs containing suspicious krbJAASFile values or externally reachable hosts
Monitor JVMs for outbound connections to LDAP (389, 636) and RMI (1099) ports where such traffic is not part of the baseline
Alert on invocations of javax.naming.InitialContext.lookup combined with remote URI schemes in application telemetry
Correlate JDBC connection events with subsequent process creation from the JVM to identify post-exploitation behavior

Monitoring Recommendations

Enable verbose logging on JDBC connection factories to capture URL properties supplied by callers
Ingest process, network, and file telemetry from hosts running Cloudera integrations into a centralized data lake for correlation
Track EPSS movement for CVE-2024-54660 to prioritize response as exploitation likelihood changes

How to Mitigate CVE-2024-54660

Immediate Actions Required

Upgrade the Cloudera JDBC Connector for Hive to version 2.6.26 or later
Upgrade the Cloudera JDBC Connector for Impala to version 2.6.35 or later
Audit applications that construct JDBC URLs from user-controlled input and enforce allowlists for supported connection properties
Restrict outbound network access from hosts running the affected drivers to only required database endpoints

Patch Information

Cloudera addressed the JNDI injection in Hive JDBC Connector 2.6.26 and Impala JDBC Connector 2.6.35. Consult Cloudera's official release notes and download portals for the fixed driver artifacts and integration guidance.

Workarounds

Reject JDBC connection strings that contain the krbJAASFile property when it is not required for the deployment
Set the JVM system property -Dcom.sun.jndi.ldap.object.trustURLCodebase=false and -Dcom.sun.jndi.rmi.object.trustURLCodebase=false to block remote codebase loading
Use network segmentation and egress filtering to prevent JVMs running the drivers from reaching arbitrary LDAP or RMI endpoints
Sanitize any user-supplied hostname, port, or property values before assembling JDBC URLs

bash

# JVM hardening flags to disable remote codebase loading via JNDI
java \
  -Dcom.sun.jndi.ldap.object.trustURLCodebase=false \
  -Dcom.sun.jndi.rmi.object.trustURLCodebase=false \
  -Dcom.sun.jndi.cosnaming.object.trustURLCodebase=false \
  -jar your-application.jar