title: “Vulnerabilities Found in Apache Ranger”

Introduction

This page contains a list of security vulnerabilities that have been found in Apache Ranger. For each vulnerability, the following information is provided:

Fixed in Ranger 2.6.0

CVE-2024-55532Improper Neutralization of Formula Elements in a CSV File in Export to CSV feature of Apache Ranger
SeverityLow
VendorThe Apache Software Foundation
Versions AffectedApache Ranger versions prior to 2.6.0
Users affectedAll users of ranger policy admin tool
DescriptionImproper Neutralization issue in Export to CSV functionality
Fix detailAdded logic to properly sanitize the exported content
MitigationUsers should upgrade to 2.6.0 or later version of Apache Ranger with the fix
Credit김도균 (a2256014@naver.com)

Fixed in Ranger 2.5.0

CVE-2024-45478Stored XSS vulnerability in Edit Service Page of Apache Ranger UI
SeverityModerate
VendorThe Apache Software Foundation
Versions AffectedApache Ranger versions prior to 2.5.0
Users affectedAll users of ranger policy admin tool UI
DescriptionApache Ranger was found to be vulnerable to a Stored XSS issue in Edit Service functionality
Fix detailAdded logic to validate the user input
MitigationUsers should upgrade to 2.5.0 or later version of Apache Ranger with the fix
CreditGyujin
CVE-2024-45479SSRF vulnerability in Edit Service Page of Apache Ranger UI
SeverityModerate
VendorThe Apache Software Foundation
Versions AffectedApache Ranger versions prior to 2.5.0
Users affectedAll users of ranger policy admin tool UI
DescriptionApache Ranger was found to be vulnerable to a SSRF issue in Edit Service functionality
Fix detailAdded logic to validate the user input
MitigationUsers should upgrade to 2.5.0 or later version of Apache Ranger with the fix
CreditGyujin

Fixed in Ranger 2.0.0

CVE-2019-12397Apache Ranger cross site scripting issue
VendorThe Apache Software Foundation
Versions Affected0.7.0 to 1.2.0 versions of Apache Ranger, prior to 2.0.0
Users affectedAll users of ranger policy admin tool
DescriptionApache Ranger was found to be vulnerable to a Cross-Site Scripting in policy import functionality
Fix detailAdded logic to sanitize the user input
MitigationUsers should upgrade to 2.0.0 or later version of Apache Ranger with the fix
CreditJan Kaszycki from STM Solutions

Fixed in Ranger 1.2.0

CVE-2018-11778Apache Ranger Stack based buffer overflow
SeverityCritical
VendorThe Apache Software Foundation
Versions AffectedApache Ranger versions prior to 1.2.0
Users affectedUnix Authentication Service users
DescriptionApache Ranger UnixAuthenticationService should properly handle user input to avoid Stack-based buffer overflow
Fix detailUnixAuthenticationService was updated to correctly handle user input
MitigationUsers should upgrade to 1.2.0 or later version of Apache Ranger with the fix
CreditAlexander Klink

Fixed in Ranger 0.7.1

CVE-2017-7676Apache Ranger policy evaluation ignores characters after ‘*’ wildcard character
SeverityCritical
VendorThe Apache Software Foundation
Versions Affected0.6.x/0.7.0 versions of Apache Ranger
Users affectedEnvironments that use Ranger policies with characters after \‘*\’ wildcard character – like my*test, test*.txt
DescriptionPolicy resource matcher effectively ignores characters after \‘*\’ wildcard character. This can result in affected policies to apply to resources where they should not be applied
Fix detailRanger policy resource matcher was updated to correctly handle wildcard matches.
MitigationUsers should upgrade to 0.7.1 or later version of Apache Ranger with the fix
CVE-2017-7677Apache Ranger Hive Authorizer should check for RWX permission when external location is specified
SeverityCritical
VendorThe Apache Software Foundation
Versions Affected0.5.x/0.6.x/0.7.0 versions of Apache Ranger
Users affectedEnvironments that use external location for hive tables
DescriptionWithout Ranger Hive Authorizer checking RWX permission when external location is specified, there is a possibility that right permissions are not required to create the table
Fix detailRanger Hive Authorizer was updated to correctly handle permission check with external location
MitigationUsers should upgrade to 0.7.1 or later version of Apache Ranger with the fix

Fixed in Ranger 0.6.3

CVE-2016-8746Apache Ranger path matching issue in policy evaluation
SeverityNormal
VendorThe Apache Software Foundation
Versions Affected0.6.0/0.6.1/0.6.2 versions of Apache Ranger
Users affectedAll users of ranger policy admin tool
DescriptionRanger policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true
Fix detailFixed policy evaluation logic
MitigationUsers should upgrade to 0.6.3 or later version of Apache Ranger with the fix
CVE-2016-8751Apache Ranger stored cross site scripting issue
SeverityNormal
VendorThe Apache Software Foundation
Versions Affected0.5.x and 0.6.0/0.6.1/0.6.2 versions of Apache Ranger
Users affectedAll users of ranger policy admin tool
DescriptionApache Ranger was found to be vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies
Fix detailAdded logic to sanitize the user input
MitigationUsers should upgrade to 0.6.3 or later version of Apache Ranger with the fix

Fixed in Ranger 0.6.2

CVE-2016-6815Apache Ranger user privilege vulnerability
SeverityNormal
VendorThe Apache Software Foundation
Versions AffectedAll 0.5.x versions or 0.6.0/0.6.1 versions of Apache Ranger
Users affectedAll users of ranger policy admin tool
DescriptionUsers with “keyadmin” role should not be allowed to change password for users with admin role
Fix detailAdded logic to validate the user privilege in the backend
MitigationUsers should upgrade to 0.6.2 or later version of Apache Ranger with the fix

Fixed in Ranger 0.6.1

CVE-2016-5395Apache Ranger Stored Cross Site Scripting vulnerability
SeverityNormal
VendorThe Apache Software Foundation
Versions AffectedAll 0.5.x versions of Apache Ranger and version 0.6.0
Users affectedAll users of ranger policy admin tool
DescriptionApache Ranger was found to be vulnerable to a Stored Cross-Site Scripting in the create user functionality. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies
Fix detailAdded logic to sanitize the user input
MitigationUsers should upgrade to 0.6.1 or later version of Apache Ranger with the fix
CreditThanks to Victor Hora from Securus Global for reporting this issue

Fixed in Ranger 0.5.3

CVE-2016-2174Apache Ranger sql injection vulnerability
SeverityNormal
VendorThe Apache Software Foundation
Versions AffectedAll versions of Apache Ranger from 0.5.0 (up to 0.5.3)
Users affectedAll admin users of ranger policy admin tool
DescriptionSQL Injection vulnerability in Audit > Access tab. When the user clicks an element from policyId row of the list, there is a call made underneath with eventTime parameter which contains the vulnerability. Admin users can send some arbitrary sql code to be executed along with eventTime parameter using /service/plugins/policies/eventTime url
Fix detailReplaced native queries with JPA named queries
MitigationUsers should upgrade to 0.5.3 version of Apache Ranger with the fix
CreditThanks to Mateusz Olejarka from SecuRing for reporting this issue

Fixed in Ranger 0.5.1

CVE-2015-5167Restrict REST API data access for non-admin users
SeverityImportant
VendorThe Apache Software Foundation
Versions Affected0.4.0 and 0.5.0 version of Apache Ranger
Users affectedAll users of ranger policy admin tool
DescriptionData access restrictions via REST API are not consistent with restrictions in policy admin UI
MitigationUsers should upgrade to Ranger 0.5.1 version
CVE-2016-0733Ranger Admin authentication issue
SeverityImportant
VendorThe Apache Software Foundation
Versions Affected0.4.0 and 0.5.0 version of Apache Ranger
Users affectedAll users of ranger policy admin tool
DescriptionMalicious Users can gain access to ranger admin UI without proper authentication
MitigationUsers should upgrade to Ranger 0.5.1 version

Fixed in Ranger 0.5.0

CVE-2015-0265Apache Ranger code injection vulnerability
SeverityImportant
VendorThe Apache Software Foundation
Versions Affected0.4.0 version of Apache Ranger
Users affectedAll admin users of ranger policy admin tool
DescriptionUnauthorized users can send some javascript code to be executed in ranger policy admin tool admin sessions
Fix detailAdded logic to sanitize the user input
MitigationUsers should upgrade to 0.5.0+ version of Apache Ranger with the fix
CreditThanks to Jakub Kałużny from SecuRing for reporting this issue
CVE-2015-0266Apache Ranger direct url access vulnerability
SeverityImportant
VendorThe Apache Software Foundation
Versions Affected0.4.0 version of Apache Ranger
Users affectedAll users of ranger policy admin tool
DescriptionRegular users can type in the URL of modules that are accessible only to admin users
Fix detailAdded logic in the backend to verify user access
MitigationUsers should upgrade to 0.5.0+ version of Apache Ranger with the fix
CreditThanks to Jakub Kałużny from SecuRing for reporting this issue