Leon Johnson

An issue exists in the Hive Metastore where direct SQL partition-name resolution allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata. This occurs when client-supplied partition names are embedded into SQL using string concatenation via the `DirectSqlUpdatePart.quoteString()` function instead of using bind parameters. A crafted partition name containing a single quote can alter the generated WHERE clause, causing lookups to match additional rows. This affects operations such as statistics updates, truncation targets, and file-metadata cache operations when the `metastore.try.direct.sql` variable is enabled. The impact is limited to table and partition targeting within tables the user can already reference, rather than arbitrary cross-database access.

An improper authorization issue exists where an authenticated user with low privileges can access the `/admin/*` endpoints in the Web Console. This occurs because the default Jetty settings fail to restrict these paths exclusively to administrators.

An authorization flaw exists in the handling of temporary destinations. While these destinations are intended to be isolated to the connection that created them, the isolation check is only performed on the client side. This allows a different connection to consume messages from another connection's temporary destination.

Incomplete authorization in the server allows authenticated connections to remove existing destinations when they possess the proper permissions.

Incorrect default permissions in Jolokia authorization settings allow authenticated low-privilege web-login accounts to access operations intended for administrators. This enables non-admin users to execute broker management operations, such as `addQueue()` and `removeQueue()`.