CVE-2022-24697: Apache Kylin Remote Code Execution
Summary
CVE-2022-24697: Apache Kylin vulnerable to remote code execution. Affects org.apache.kylin:kylin-core-common versions < 4.0.2. Fixed in 4.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kylin is an open-source distributed analytics engine designed to provide OLAP (Online Analytical Processing) capability on big data. It allows users to query large datasets in real-time and build data cubes for efficient analysis. Kylin is widely used in various industries for business intelligence and data analytics purposes. However, versions 2.6.5 and earlier of Kylin are vulnerable to remote code execution.
Vulnerability Detail
The vulnerability in Apache Kylin resides in its cube designer function, specifically in the configuration overwrites menu. By manipulating the system parameters, an attacker can inject arbitrary operating system commands into the command line parameters. This can lead to remote code execution (RCE) on the affected system. The vulnerability has a critical severity rating with a CVSS score of 9.8. It affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
How To Fix
Minimum fixed version
4.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable or restrict access to the cube designer function in Apache Kylin. By limiting the exposure of this vulnerable feature, the risk of exploitation can be reduced. However, this is not a permanent solution, and upgrading to a patched version is strongly advised.
Conclusion
Apache Kylin versions 2.6.5 and earlier, 3.1.2 and earlier, and 4.0.1 and earlier are vulnerable to remote code execution. It is crucial to upgrade to Kylin version 4.0.2 or later to mitigate this vulnerability. Regularly updating the software and applying security patches is essential to ensure the security of your system. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin-core-common →
FAQ
Apache Kylin is an open-source distributed analytics engine that provides OLAP capability on big data. It allows users to query large datasets in real-time and build data cubes for efficient analysis.
The vulnerability in Apache Kylin allows remote code execution, which can lead to unauthorized access, data breaches, and potential compromise of the affected system.
Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier are affected by this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Kylin version 4.0.2 or later. Ensure that you keep your software up to date with the latest security patches.
As a temporary workaround, you can disable or restrict access to the cube designer function in Apache Kylin. However, upgrading to a patched version is strongly advised.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin-core-common.
