Multiple vulnerabilities in Apache Kylin

1) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU59279

Risk: High

CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-27738

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in "StreamingCoordinatorController.java" when handling requests sent to "/kylin/api/streaming_coordinator/*" REST API endpoints. A remote non-authenticated attacker can send a specially crafted HTTP request and force the application to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kylin: 3.0.0 - 3.1.2

External links

http://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70
http://www.openwall.com/lists/oss-security/2022/01/06/6

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU59278

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-36774

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected application.

The vulnerability exists due to Apache Kylin allows users to read data from other database systems using JDBC. A remote user can execute arbitrary code from a controlled malicious MySQL server within Kylin server processes.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kylin: 2.0.0 - 3.1.2

External links

http://lists.apache.org/thread/lchpcvoolc6w8zc6vo1wstk8zbfqv2ow
http://www.openwall.com/lists/oss-security/2022/01/06/5

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Input validation error

EUVDB-ID: #VU59277

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-31522

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected application.

The vulnerability exists due to the application allows to load any class through Class.forName(...) call. A remote user can execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kylin: 2.0.0 - 4.0.0

External links

http://lists.apache.org/thread/hh5crx3yr701zd8wtpqo1mww2rlkvznw
http://www.openwall.com/lists/oss-security/2022/01/06/4

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Storing passwords in a recoverable format

EUVDB-ID: #VU59276

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-45458

CWE-ID: CWE-257 - Storing Passwords in a Recoverable Format

Exploit availability: No

Description

The vulnerability allows a local user to decrypt passwords.

The vulnerability exists due to the way users' passwords are encrypted with the PasswordPlaceholderConfigurer  class with hard-coded key and IV. A local user with ability to read Apache Kylin configuration file can obtain hard-coded key and IV and decrypt passwords of application users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kylin: 2.0.0 - 4.0.0

External links

http://lists.apache.org/thread/oof215qz188k16vhlo97cm1jksxdowfy
http://www.openwall.com/lists/oss-security/2022/01/06/3
http://www.openwall.com/lists/oss-security/2022/01/06/7

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Origin validation error

EUVDB-ID: #VU59275

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-45457

CWE-ID: CWE-346 - Origin Validation Error

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insecure application configuration that allows cross-origin requests with credentials to be sent from any origin. A remote attacker can exploit this vulnerability to bypass browser protection mechanisms and perform XSS attacks against application users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kylin: 2.0.0 - 4.0.0

External links

http://lists.apache.org/thread/rzv4mq58okwj1n88lry82ol2wwm57q1m
http://www.openwall.com/lists/oss-security/2022/01/06/2

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) OS Command Injection

EUVDB-ID: #VU59274

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-45456

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exist due to improper input validation when processing project names. A remote user can pass a specially crafted project name that is later passed as the shell command argument in DiagnosisService and execute arbitrary OS commands on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Apache Kylin: 4.0.0

External links

http://lists.apache.org/thread/70fkf9w1swt2cqdcz13rwfjvblw1fcpf
http://www.openwall.com/lists/oss-security/2022/01/06/1

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.