Kingdom: Input Validation and Representation
Input validation and representation problems ares caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input. The issues include: "Buffer Overflows," "Cross-Site Scripting" attacks, "SQL Injection," and many others.
Hadoop Cluster Manipulation
Abstract
The program allows an attacker to control core components of the Hadoop cluster on which the client application runs.
Explanation
Hadoop cluster control errors occur when:
- Data enters a program from an untrusted source.
- The data is consumed by Hadoop cluster core components such as
Hadoop clusters are a hostile environment. When security configurations from protecting unauthorized access to cluster nodes are not set properly, an attack may be able to take control the infrastructure. This leads to the possibility that any data that is provided by the Hadoop cluster to be tampered.
Example 1: The following code shows a
- Data enters a program from an untrusted source.
- The data is consumed by Hadoop cluster core components such as
NameNode
, DataNode
, JobTraker
to change the state of the cluster.Hadoop clusters are a hostile environment. When security configurations from protecting unauthorized access to cluster nodes are not set properly, an attack may be able to take control the infrastructure. This leads to the possibility that any data that is provided by the Hadoop cluster to be tampered.
Example 1: The following code shows a
Job
submission in a typical client application which takes inputs from command line on Hadoop cluster master machine:
public static void run(String args[]) throws IOException {
String path = "/path/to/a/file";
DFSclient client = new DFSClient(arg[1], new Configuration());
ClientProtocol nNode = client.getNameNode();
/* This sets the ownership of a file pointed by the path to a user identified
* by command line arguments.
*/
nNode.setOwner(path, args[2], args[3]);
...
}
References
[1] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-002754
[2] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)
[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation
[5] Standards Mapping - OWASP Mobile 2024 M4 Insufficient Input/Output Validation
[6] Standards Mapping - OWASP Top 10 2004 A1 Unvalidated Input
[7] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1
[8] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1
[9] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1
[10] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1
[11] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[12] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[13] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation
[14] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation
[15] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002560 CAT I
[16] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002560 CAT I
[17] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002560 CAT I
[18] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002560 CAT I
[19] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002560 CAT I
[20] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002560 CAT I
[21] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002560 CAT I
[22] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002560 CAT I
[23] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002560 CAT I
[24] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002560 CAT I
[25] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002560 CAT I
[26] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002560 CAT I
[27] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002560 CAT I
[28] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I
[29] Standards Mapping - Security Technical Implementation Guide Version 6.1 APSC-DV-002530 CAT II, APSC-DV-002560 CAT I
[30] Standards Mapping - Web Application Security Consortium Version 2.00 Improper Input Handling (WASC-20)
desc.dataflow.java.hadoop_cluster_manipulation