AI analysis
Apache Impala contains a server-side request forgery (CWE-918) in its handling of the Avro schema URL table property. An attacker who can create or alter a table can set tblproperties('avro.schema.url'='http://...') — or use a 'file:///' URI — causing Impala (versions 2.0.0 through 4.5.1, on all platforms) to issue a GET request to an internal endpoint that the attacker may not have direct access to but that Impala can reach. The attacker gains SSRF access to internal services reachable from Impala, and the response content may be disclosed back to the attacker through Avro schema parsing error messages. All users running affected Impala versions 2.0.0 to 4.5.1 are exposed, with risk concentrated in environments where users can define or modify table properties and Impala can reach internal endpoints such as management interfaces or cloud metadata services. There are no known public proof-of-concept exploits, no confirmed in-the-wild exploitation, and the issue is not listed in CISA's KEV; the flaw is fixed in Impala 4.5.2.
What to do: Upgrade to Apache Impala 4.5.2, which fixes this issue. Until then, restrict which users can run CREATE/ALTER TABLE and set the 'avro.schema.url' table property, allow-list or validate schema URLs (banning 'file:///' and untrusted 'http://' targets), and block Impala's network access to sensitive internal endpoints such as cluster management interfaces and cloud metadata services. Because SSRF responses can leak through parsing errors, review table properties on existing tables for attacker-controlled URLs.
Affected
| Apache Impala | 2.0.0 to 4.5.1 (all platforms) |
Estimated exposure
moderate≈1,000–10,000 deployments (enterprise big-data clusters; estimated, no public install counts) — Impala is deployed mainly inside enterprise data-lake/warehouse clusters rather than as internet-facing services, so the exposed base is inferred from typical deployment patterns in the thousands of clusters, not from public scan or…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Specifying tblproperties('avro.schema.url'=' http://...' ) or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error messages. Users are recommended to upgrade to version 4.5.2, which fixes this issue.