Server-Side Request Forgery (SSRF) in Apache Kylin - CVE-2021-27738

Detailed vulnerability description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in "StreamingCoordinatorController.java" when handling requests sent to "/kylin/api/streaming_coordinator/*" REST API endpoints. A remote non-authenticated attacker can send a specially crafted HTTP request and force the application to issue arbitrary requests, such as assigning/unassigning of streaming cubes, creation/modification and deletion of replica sets, to the Kylin Coordinator.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

How to mitigate CVE-2021-27738

Sources

• https://lists.apache.org/thread/vkohh0to2vzwymyb2x13fszs3cs3vd70
• http://www.openwall.com/lists/oss-security/2022/01/06/6