CVE-2022-43396: Apache Kylin Command Injection Vulnerability
Summary
CVE-2022-43396: Apache Kylin vulnerable to Command injection by Useless configuration. Affects org.apache.kylin:kylin versions >= 2.0.0, < 4.0.3. Fixed in 4.0.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Kylin is an open-source distributed analytics engine designed to provide OLAP (Online Analytical Processing) capability on big data. It allows users to query large datasets in real-time using SQL-like queries. Kylin leverages Apache Spark for distributed computing and supports various data sources, including Hadoop HDFS, Hive, and HBase. However, a vulnerability has been discovered in Kylin that allows for command injection through a misconfiguration.
Vulnerability Detail
The vulnerability, identified as CVE-2022-43396, arises from a flaw in the fix for a previous vulnerability (CVE-2022-24697). While a blacklist is implemented to filter user input commands, it can be bypassed, enabling an attacker to control the command by manipulating the kylin.engine.spark-cmd parameter in the conf configuration. This command injection vulnerability poses a high risk as it allows an authenticated attacker to execute arbitrary commands with the privileges of the Kylin process. The impact of successful exploitation includes unauthorized access, data manipulation, and potential compromise of the underlying system.
How To Fix
Minimum fixed version
4.0.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can manually inspect and sanitize the kylin.engine.spark-cmd parameter in the conf configuration. Ensure that the parameter only allows necessary and safe commands, and restrict any user input that may be used for command injection. Here is an example of how to sanitize the parameter using Java code:
String sparkCmd = conf.get("kylin.engine.spark-cmd");
String sanitizedCmd = sparkCmd.replaceAll("[^a-zA-Z0-9\\s]", "");
conf.set("kylin.engine.spark-cmd", sanitizedCmd);
This code snippet removes any non-alphanumeric characters from the kylin.engine.spark-cmd parameter, reducing the risk of command injection.
Conclusion
The Apache Kylin Command Injection Vulnerability (CVE-2022-43396) poses a significant risk to Kylin deployments. It allows authenticated attackers to execute arbitrary commands with the privileges of the Kylin process, potentially leading to unauthorized access and data manipulation. To mitigate this vulnerability, users should upgrade to Apache Kylin version 4.0.3 or later. Additionally, a temporary workaround is available by manually sanitizing the kylin.engine.spark-cmd parameter in the conf configuration. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.kylin:kylin →
FAQ
Apache Kylin is an open-source distributed analytics engine that provides OLAP capability on big data. It allows users to query large datasets in real-time using SQL-like queries.
The vulnerability allows an authenticated attacker to execute arbitrary commands with the privileges of the Kylin process. This can lead to unauthorized access, data manipulation, and potential compromise of the underlying system.
To fix this vulnerability, it is recommended to upgrade to Apache Kylin version 4.0.3 or later. This version includes a patch that properly filters user input commands, preventing command injection attacks.
As a temporary workaround, users can manually inspect and sanitize the kylin.engine.spark-cmd parameter in the conf configuration. Ensure that the parameter only allows necessary and safe commands, and restrict any user input that may be used for command injection.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry at: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-f5q9-j9r2-34gq/GHSA-f5q9-j9r2-34gq.json
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.kylin:kylin.
