Apache Hive versions 2.1.0 through 4.2.0 are vulnerable to a critical Server-Side Request Forgery flaw that allows authenticated attackers to exfiltrate cloud metadata or access internal network services.

This vulnerability is a Server-Side Request Forgery (CWE-918) occurring within the Avro SerDe schema resolution process. It requires the attacker to have authenticated access to the Hive environment and the ability to execute DDL operations, specifically the CREATE TABLE privilege, to set the malicious avro.schema.url property.

Successful exploitation permits an attacker to perform unauthorized requests from the Hive server, leading to the potential exposure of sensitive cloud instance metadata, internal network resources, or local files. Given the CVSS score of 9.1, this vulnerability poses a critical risk to data confidentiality and integrity, as it provides a pathway for an attacker to pivot into protected internal infrastructure.

Immediate Action: Upgrade to Apache Hive version 4.2.1 or later immediately to resolve the vulnerable Avro SerDe schema resolution logic.

Proactive Monitoring: Review Hive access logs for suspicious CREATE TABLE statements and monitor outbound network traffic from the HiveServer2 and Metastore services for connections to unexpected or internal endpoints.

Compensating Controls: Implement strict network segmentation and egress filtering on the Hive server to prevent it from reaching sensitive cloud metadata services (e.g., 169.254.169.254) or unauthorized internal network segments.

Public Exploit Available: exploit_available (unknown)

The critical nature of this SSRF vulnerability necessitates prompt attention, particularly in cloud-native environments where instance metadata exposure can lead to full account compromise. Administrators must prioritize updating to version 4.2.1 and review existing user permissions to ensure that the ability to perform DDL operations is restricted to trusted personnel only.