CVE-2020-1956: Command Injection in Kylin
Summary
CVE-2020-1956: Command Injection in Kylin. Affects org.apache.kylin:kylin-core-common across 2 version ranges.
< 2.6.6
>= 3.0.0, < 3.0.2
Fixed in 2.6.6 or 3.0.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kylin is an open-source distributed analytics engine designed to provide SQL interface and multi-dimensional analysis (OLAP) on Hadoop supporting extremely large datasets. It has a set of RESTful APIs that allow users to interact with the system. However, these APIs concatenate user input with OS commands without proper validation or protection, leading to a command injection vulnerability.
Vulnerability Detail
The command injection vulnerability in Kylin allows an attacker to execute arbitrary OS commands by manipulating user input. This can lead to unauthorized access, data leakage, and potential compromise of the entire system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.6.62.6.6 -
>= 3.0.0, < 3.0.23.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to disable or restrict access to the affected RESTful APIs in Kylin. This can be done by modifying the configuration or access control settings to limit the exposure of the vulnerable endpoints.
Conclusion
The command injection vulnerability in Kylin poses a significant security risk and should be addressed promptly. Upgrading to the fixed versions or implementing the provided workaround will help mitigate the vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin-core-common →
FAQ
Kylin is an open-source distributed analytics engine designed for big data processing and analysis.
A command injection vulnerability allows an attacker to execute arbitrary commands on a target system by manipulating user input.
The vulnerability can lead to unauthorized access, data leakage, and compromise of the entire system.
Upgrade to the fixed versions of Kylin (2.6.6 or 3.0.2) that include proper validation and protection against command injection attacks.
As a temporary workaround, you can disable or restrict access to the affected RESTful APIs in Kylin.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin-core-common.
