Apache Kylin

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.

Command injection

Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters

Apache Kylin: Command injection by Diagnosis Controller

Apache Kylin unsafe class loading

Apache Kylin: OS Command Injection via Async Query API

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.

Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API

Apache Kylin: Session fixation in web interface

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Apache Kylin: Command injection by Useless configuration

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

Apache Kylin: improper restriction of file read

Improper Access Control to Streaming Coordinator & SSRF

Overly broad CORS configuration

Hardcoded credentials

Apache Kylin: Authentication bypass

Apache Kylin: Insufficiently protected credentials in config file

Apache Kylin: Server-Side Request Forgery

Apache Kylin: The remote code execution via jdbc url

Mysql JDBC Connector Deserialize RCE

Apache Kylin: SSRF vulnerability in the diagnosis api

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.

Apache Kylin: Improper authorization in job information retrieval