Vulnerability Details CVE-2020-1956
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.937
EPSS Ranking 99.8%
CVSS Severity
CVSS v3 Score 8.8
CVSS v2 Score 9.0
Proposed Action
Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execution.
Ransomware Campaign
Unknown
References
- http://www.openwall.com/lists/oss-security/2020/07/14/1
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E
- http://www.openwall.com/lists/oss-security/2020/07/14/1
- https://community.sonarsource.com/t/apache-kylin-3-0-1-command-injection-vulnerability/25706
- https://lists.apache.org/thread.html/r021baf9d8d4ae41e8c8332c167c4fa96c91b5086563d9be55d2d7acf%40%3Ccommits.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r1332ef34cf8e2c0589cf44ad269fb1fb4c06addec6297f0320f5111d%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cdev.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r250a867961cfd6e0506240a9c7eaee782d84c6ab0091c7c4bc45f3eb%40%3Cuser.kylin.apache.org%3E
- https://lists.apache.org/thread.html/r61666760d8a4e8764b2d5fe158d8a48b569414480fbfadede574cdc0%40%3Ccommits.kylin.apache.org%3E
Products affected by CVE-2020-1956
-
cpe:2.3:a:apache:kylin:2.3.0
-
cpe:2.3:a:apache:kylin:2.3.1
-
cpe:2.3:a:apache:kylin:2.3.2
-
cpe:2.3:a:apache:kylin:2.4.0
-
cpe:2.3:a:apache:kylin:2.4.1
-
cpe:2.3:a:apache:kylin:2.5.0
-
cpe:2.3:a:apache:kylin:2.5.1
-
cpe:2.3:a:apache:kylin:2.5.2
-
cpe:2.3:a:apache:kylin:2.6.0
-
cpe:2.3:a:apache:kylin:2.6.1
-
cpe:2.3:a:apache:kylin:2.6.2
-
cpe:2.3:a:apache:kylin:2.6.3
-
cpe:2.3:a:apache:kylin:2.6.4
-
cpe:2.3:a:apache:kylin:2.6.5
-
cpe:2.3:a:apache:kylin:3.0.0
-
cpe:2.3:a:apache:kylin:3.0.1