Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-23945

CVE-2024-23945: Apache Hive and Spark: CookieSigner exposes the correct signature when message verification fails

5.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-23945
GHSA ID
GHSA-77pm-w3hx-f8mj
EPSS Score
0.75277%
CWE
CWE-209
Published
12/23/2024
Updated
12/26/2024
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.apache.hive:hive-servicemaven>= 1.2.0, < 4.0.04.0.0
org.apache.spark:spark-hive-thriftserver_2.11maven<= 2.4.8
org.apache.spark:spark-hive-thriftserver_2.12maven< 3.4.23.4.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from error message generation in the CookieSigner's.verifyAndExtract method. Both Hive and Spark implementations originally included the originalSignature (correct signature) in exception messages when signature validation failed, as shown in the commit diffs. This violates CWE-209 by exposing cryptographic material through error messages. The patches (7638cb1 for Hive, cf59b1f for Spark) explicitly remove the sensitive signature details from error messages, confirming these functions as the root cause.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Si*nin* *ooki*s is *n *ppli**tion s**urity ***tur* t**t ***s * *i*it*l si*n*tur* to *ooki* **t* to v*ri*y its *ut**nti*ity *n* int**rity. T** si*n*tur* **lps pr*v*nt m*li*ious **tors *rom mo*i*yin* t** *ooki* v*lu*, w*i** **n l*** to s**urity vuln*r*

Reasoning

T** vuln*r**ility st*ms *rom *rror m*ss*** **n*r*tion in t** `*ooki*Si*n*r's.v*ri*y*n**xtr**t` m*t*o*. *ot* *iv* *n* Sp*rk impl*m*nt*tions ori*in*lly in*lu*** t** `ori*in*lSi*n*tur*` (*orr**t si*n*tur*) in *x**ption m*ss***s w**n si*n*tur* v*li**tion